Logstash - replace @timestamp

Elastic Stack Logstash
1

Hi,

Looking for help with a date and time filter in logstash. I created a new Time field putting together a previous date and time field that I subsequently drop.

The new Time field looks like the below in my output:
"Time":"2021-01-05 00:00:10"

I have tried the following filters, but still not getting it to replace the @timestamp:

	date { 
		match => [ "Time", "[yyyy-MM-dd HH:mm:ss]" ]
		target => "@timestamp"
	}

and

	date { 
		match => [ "Time", "[YYYY-MM-dd HH:mm:ss]" ]
		target => "@timestamp"
	}

neither has worked. Any other suggestion would be great

2

There is no [ and ] around the time format.

You should use

date { 
    match => [ "Time", "yyyy-MM-dd HH:mm:ss" ]
}

You also don't need the target option if your target is the @timestamp field.

3

Tremendous, couldn't see what was right in front of my eyes!!

thank you

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.