Parsing date in logstsh

Hi team,
I havee csv file with following data:
name,age,gender,country,logtime
John,34,male,China,2019-05-12 08:10
Basil,43,male,Taiwan,2020-05-13 8:10
Bella,25,female,USA,2018-05-14 8:10
I am using date parser as:
date {
match => [ "logtime", "YYYY-MM-dd HH:mm" ]
target => "@timestamp"
timezone => "Canada/Eastern"
}
but it fails to do date parsing.
When I remove HH:mm from match and remove time from csv it works.
How can i match data like : Bella,25,female,USA,2018-05-14 8:10:02

You have two format: 2018-05-14 8:10 and 2018-05-14 8:10:02.

	 date {
      match => [ "logtime", "YYYY-MM-dd HH:mm", "YYYY-MM-dd HH:mm:ss"]
      target => "@timestamp"
      timezone => "Canada/Eastern"
	 }

I have data with without 'second' part like below:
name,age,gender,country,logtime
John,34,male,China,2019-05-12 08:10
date {
match => [ "logtime", "YYYY-MM-dd HH:mm" ]
target => "@timestamp"
timezone => "Canada/Eastern"
}
But above still fails

This code is working fine:


	 mutate {
	   add_field  => { "logtime" => "2018-05-14 8:10" }
	 }
	 
	 date {
      match => [ "logtime", "YYYY-MM-dd H:mm"]
      target => "@timestamp"
      timezone => "Canada/Eastern"


	 }

date-form
You can also try HH if you have 2 digits in hours and try different zone: America/Toronto.
match => [ "logtime", "YYYY-MM-dd HH:mm"]
If still is not working use ruby debugger to see values.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.