Hi all, I have two types of timestamps coming into my logstash input from different logfiles: [6/13/18 8:11:25:022 CEST] 2018-04-17T15:19:20.313 My grok below works for both: if [fields][log_type] == "p8_server_error" { grok { match => [ "message", "%{TIMESTAMP_ISO8601:logda…

Your pattern does not match your date. The separator for milliseconds is colon, not period. Try date { match => [ "message", "yyyy-MM-dd'T'HH:mm:ss.SSS", "MM/dd/yy HH:mm:ss:SSS" ] } If you want to include the timezone then you will have to do something like mutate { gsub => [ "message", "CEST", "…

Discuss the Elastic Stack

Parsing different date formats (difficult)

Elastic Stack Logstash

bab (Broou) July 5, 2018, 5:12pm 9

thnak you @Badger it's work now

Topic		Replies	Views
Date format match Logstash	5	433	July 10, 2018
ISO8601 date format : malformed error message in elasticsearch Logstash	9	10177	November 9, 2017
Date format parsing Logstash	5	933	April 23, 2018
Failed to parse date - Elasticsearch 2.2 / Logstash 2.2 Elasticsearch	4	1034	July 5, 2017
Parsing the date and sending to ElasticSearch Logstash	13	7963	May 26, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Parsing different date formats (difficult)

Related topics