I have two inputs pulling in data in different formats. My problem is the timestamps are causing issues. The first looks like something this 2018-09-21T22:13:27.161Z and the second will have this format 4/11/18 17:19
The Date Filter, which populates the @timestamp by parsing the value in another field, takes a list of formats. It will try each in succession, stopping only when it finds a match or reaches the end of the list. Once populated, the @timestamp is a timestamp object, representing a specific moment in time. It can be formatted into a String using the sprintf syntax.
The first format you list is ISO8601, a well-recognised international standard.
The second format is potentially ambiguous. Is that April 11th, 2018, or is it November 4th, 2018?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.