Merge date and time field

Elastic Stack Logstash
1

So, I have been trying to parse fortigate logs using logstash, I came across date and time fields, in fortigate there are two different fields, I tried to parse those fileds
using

mutate {add_field => { "@timestamp" => "%{date} %{time}" }}
date {
    match => [ "@timestamp", "MMM dd yyyy HH:mm:ss", "MMM  d yyyy HH:mm:ss", "ISO8601" ]
    timezone => "Asia/Karachi"
    #target => "@timestamp"
    }

and I got below mentioned ans
date=2020-07-28 time=01:24:44
"@timestamp" => 2020-07-28T08:31:40.739Z
where date is correct by time is 8 rather than 01,
can someone help here

2

In my original config target field is not commented

3

Is that the value of %{date} and %{time}?

4

yes it is

5

I see two problems:

  1. That should have given you a _mutate_error when you tried to overwrite @timestamp with an array (by adding a second value to the existing one) as it has to be a timestamp.
  2. Your date patterns don't match your input.

You can do it like this:

mutate {
    add_field => { "ts" => "%{date}T%{time}" }
}
date {
  match => [ "ts", "ISO8601" ]
  timezone => "Asia/Karachi"
  remove_field => "ts"
}
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.