Hi team,
I havee csv file with following data:
name,age,gender,country,logtime
John,34,male,China,2019-05-12 08:10
Basil,43,male,Taiwan,2020-05-13 8:10
Bella,25,female,USA,2018-05-14 8:10
I am using date parser as:
date {
match => [ "logtime", "YYYY-MM-dd HH:mm" ]
target => "@timestamp"
timezone => "Canada/Eastern"
}
but it fails to do date parsing.
When I remove HH:mm from match and remove time from csv it works.
How can i match data like : Bella,25,female,USA,2018-05-14 8:10:02
You have two format: 2018-05-14 8:10 and 2018-05-14 8:10:02.
date {
match => [ "logtime", "YYYY-MM-dd HH:mm", "YYYY-MM-dd HH:mm:ss"]
target => "@timestamp"
timezone => "Canada/Eastern"
}
I have data with without 'second' part like below:
name,age,gender,country,logtime
John,34,male,China,2019-05-12 08:10
date {
match => [ "logtime", "YYYY-MM-dd HH:mm" ]
target => "@timestamp"
timezone => "Canada/Eastern"
}
But above still fails
This code is working fine:
mutate {
add_field => { "logtime" => "2018-05-14 8:10" }
}
date {
match => [ "logtime", "YYYY-MM-dd H:mm"]
target => "@timestamp"
timezone => "Canada/Eastern"
}
You can also try HH if you have 2 digits in hours and try different zone: America/Toronto.
match => [ "logtime", "YYYY-MM-dd HH:mm"]
If still is not working use ruby debugger to see values.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.