Problem in Parsing date

Elastic Stack Logstash
1

Hi,

I am facing an unique problem. I have a server in USA which is generating with timestamp like "<Mar 16, 2018 9:11:01 AM UTC>"

Can anyone tell me how to handle UTC part? The date is already in UTC and I don't want to change the date but logstash is changing it as the server is in USA.

Right Now I am doing like :

In grok : <%{DATA:Timestamp} UTC>

So here Timestamp = Mar 16, 2018 9:11:01 AM

Then:

date {
match => [ "Timestamp",
"MMM dd, YYYY KK:mm:ss aa",
"MMM d, YYYY KK:mm:ss aa" ]
target => "@timestamp"
timezone => "UTC"
}

Now sure how to handle "UTC".

Thanks & Regards,
Debashis Adak

2

You do not need to specify the second one, it is implied by the first.

For the message "Mar 6, 2018 9:11:01 PM UTC"

  grok { match => { "message" => "%{DATA:Timestamp} UTC" } }
  date { match => [ "Timestamp", "MMM dd, YYYY KK:mm:ss aa" ] target => "@timestamp" timezone => "UTC" }

will produce

     "Timestamp" => "Mar 6, 2018 9:11:01 PM",
    "@timestamp" => 2018-03-06T21:11:01.000Z

What is the problem with that?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.