Mismatch in custom date throws __dateparsefailure logstash

Elastic Stack Logstash
1

The input is comma separated values: "2010-08-19","09:12:55","56095675"

I created the custom date_time field which appears to right format 2010-08-19;09:12:55 but not matching.

filter {
 grok {
    match => { "message" => '"(%{GREEDYDATA:cust_date})","(%{TIME:cust_time})","(%{NUMBER:author})"'}
    add_field => {
            "date_time" => "%{cust_date};%{cust_time}"
    }
}

date {
  match => ["date_time", "yyyy-MM-dd;hh:mm:ss"]
  target => "@timestamp"
  add_field => { "debug" => "timestampMatched"}
}

Output on Kibana:

cust_date       August 18th 2010, 20:00:00.000
cust_time       09:12:55
date_time       2010-08-19;09:12:55
message         "2010-08-19","09:12:55","56095675"
tags        beats_input_codec_plain_applied, _dateparsefailure

It gives _dateparsefailure. The fields appear to be same as match pattern. I tried different time format like YYYY-MM-dd;hh:mm:ss and YYYY-MM-dd;HH:mm:ss

What am I doing wrong? Help!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.