Parsing timestamp

Elastic Stack Logstash
#1

trying to parse with this :slight_smile:

if "one-sync" in [tags] and "heart-sync" in [tags] and "edemand" in [tags] and "events" in [tags] {
    date {
        match => ["timestamp", "yyyy-MM-dd'T'HH:mm:ss'.'SSS'Z'"]
        timezone => "GMT"
        target => "@timestamp"}

log looks like this:
{"level":"debug","message":"Received resonse 4611 ","timestamp":"2022-05-26T12:06:11.079Z"}

#2

What is the question?

#3

Since you already have in the valid time format, use:

      date {
        match => [ "timestamp", "ISO8601" ]
      }
#4

Well, it doesn't seem to parse the date. It doesn't throw an error just doesn't work,
Perhaps the conditionig syntext is off ?

#5

If there is no _dateparsefailure tag then either the source field does not exist or the conditional is preventing the date filter from processing the event.

#6

If there is no error, that means it's fine now on LS side, recreate index pattern because time was string before, now is date.

#7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.