Parse date field

Elastic Stack Logstash
1

Hi guys,

i'm injecting data from an oracle database with jdbc plugin. But i'm having trouble parsing date from a field.
Below is a data example,

{
                  "data" => 2024-10-22T16:07:54Z,
        "transaction_id" => "a3767673-2087-4bb4-a103-91c6f845bf82",
                  "tipo" => nil,
       "cotacao_cliente" => 0.0,
                    "id" => 2297.0,
                  "opex" => 0.0,
             "bandwidth" => 0.0,
           "observacoes" => "Some random text here",
              "concelho" => nil,
              "@version" => "1",
          "cotacao_rede" => 0.0,
              "services" => "L3",
                  "tags" => [
        [0] "_dateparsefailure"
    ],
    "distancia_total_fo" => nil,
          "anel_metroet" => nil,
            "@timestamp" => 2024-10-23T16:27:00.371297Z,
                  "ptr2" => nil,
      "opex_equivalente" => 0.0,
                  "zona" => nil,
         "cotacao_total" => 0.0
}

The field i want to parse is "data" => 2024-10-22T16:07:54Z

i'm trying the following,

date {
	  match => [ "data", "ISO8601", "yyyy-MM-dd'T'HH:mm:ssZ", "yyyy-MM-dd'T'HH:mm:ss'Z'" ]
	}

but always get dateparsefailure.

Anyone can help understand what is wrong?

Thanks in advance.

2

Hello,

From what you shared the data field is already a date type field in Logstash, so there is no need to parse it.

I do not use the jdbc plugin or input, but if I'm not wrong it will convert any date field into a date type in Logstash, you wouldn't need to use the date filter.

1 Like
3

As Leandro says, the jdbc input has already parsed the date for you. You can tell that in the rubydebug output because the value does not have quotes around it.

1 Like
4

that's it @leandrojmp and @Badger. In fact i didn't recognize that 'data' field is already a date type.
JDBC input plugin already set field type for every fields.

Thanks a lot for your help.