Logstash Two Different Date Format

Elastic Stack Logstash
1

I am parsing data from mysql to kibana. I have datefield which has datatype varchar
now i have two different date format that is 1/4/2020 2:17:23 PM and 1/1/2020 12:00:00 AM
can anyone please tell me what is the correct date format to parse both date and when data is parse the date datatype should be date.
I am trying 1/1/2020 12:00:00 AM
date {
match => ["Date","M/d/yyyy H:mm:ss a"]
target => "Date"

2

As described at https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html you can specify multiple patterns to try matching against. For the examples you mention try this:

 match => ["Date","M/d/yyyy H:mm:ss a", "M/d/yyyy HH:mm:ss a"]

Note that neither of those patterns will match if the date or the month has more than one digit.

3

I have try this date format but date still is string not date datatype

4

This is not true.

input { generator { count => 1 lines => [ '10/21/2020 12:00:00 AM' ] } }
filter { date { match => [ "message", "M/d/yyyy H:mm:ss a" ] } }

parses that date just fine.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.