Logstash - Unable to match date pattern

Elastic Stack Logstash
1

I am using a json input to filter some data and sent it to elasticsearch;

sample document from input json file:

{"preview":false,"offset":0,"result":{"@timestamp":"2016-11-30T21:59:43.000Z","@version":"1","_raw":"{ ..}}

I want my corresponding elasticsearch event to have the exact same timestamp as above;

However the following :

  date {
    match => [ "[result][@timestamp]", "yyyy-MM-ddTHH:mm:ss.000Z" ]
    tag_on_failure => ["no_date_match"]
  }

yields

Exception", :message=>"Illegal pattern component: T"

Have also tried: "yyyy-MM-dd HH:mm:ss.000Z

but then I just get match failure.

Which pattern should I use?

2

This seems to be working:

yyyy-MM-dd'T'HH:mm:ss.000Z

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.