Logstash time parsing error

Elastic Stack Logstash
1

I have come across with logstash date parsing error like the follow.

←[33mFailed parsing date from field {:field=>"Date", :value=>"Sep 19, 2015 10:16:36 PM HKT", :exception=>"Invalid format
: "Sep 19, 2015 10:16:36 PM HKT" is malformed at " 19, 2015 10:16:36 PM HKT"", :config_parsers=>"MMM dd, yyyy HH:mm:
ss aa Z,MMM d, yyyy HH:mm:ss aa Z", :config_locale=>"default=en_US", :level=>:warn}←[0m

How can I solve that?

2

I can't reproduce that error:

$ cat test.config
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
  date {
    match => ["message", "MMM dd, yyyy HH:mm:ss aa Z"]
  }
}
$ echo 'Sep 19, 2015 10:16:36 PM HKT' | /opt/logstash/bin/logstash -f test.config
Settings: Default pipeline workers: 2
Pipeline main started
Failed parsing date from field {:field=>"message", :value=>"Sep 19, 2015 10:16:36 PM HKT", :exception=>"Invalid format: \"Sep 19, 2015 10:16:36 PM HKT\" is malformed at \"HKT\"", :config_parsers=>"MMM dd, yyyy HH:mm:ss aa Z", :config_locale=>"default=en_US", :level=>:warn}
{
       "message" => "Sep 19, 2015 10:16:36 PM HKT",
      "@version" => "1",
    "@timestamp" => "2016-06-14T17:52:46.594Z",
          "host" => "hallonet",
          "tags" => [
        [0] "_dateparsefailure"
    ]
}
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}

However, as this example shows the date filter—as documented—isn't capable of parsing timezone names.

3

Thanks for your information.
I have made a workaround in just collecting the Sep 19, 2015 10:16:36 PM without timezone and successfully parse as @timestamp. But yet another problem is that it automatically turns my timestamp from +8 to +0 as shown below.

           "@timestamp" => "2015-09-19T02:16:52.000Z",
                 "Date" => "Sep 19, 2015 10:16:52 PM ",

How can I configure it to use localtime or how to configure kibana to turn back the timestamp to localtime for analytics?

4

The @timestamp field is always UTC. Kibana will by default convert it back to the browser's timezone.