Hello everyone,
I am trying to load a csv file that contains a DATE field but to load a date with a year "2019" it load "1970" like the following example :
Code retour:
00
SDT:
AHSCPCB2
Valeur après modif:
-
@version:
1
Date et heure:
Jun 19, 1970 @ 18:53:00.000
message:
19/06/2019 16:53,,1,Appel à la passerelle par une application cliente,00,TEST_ESHMA,0990,CO,TA-AHSCPCB2-0,NON,V2,,AHSCPCB2
Type de table:
CO
path:
C:/Users/BEKRISO/KIBANA7.0.1/INPUT/ESHMA_V2_9r_piste_audit.csv
Utilisateur:
-
Code:
1
host:
CAS0000658713
Application:
TEST_ESHMA
Valeur avant modif:
V2
Usage cache:
NON
@timestamp:
Jun 25, 2019 @ 10:57:04.962
Objet Start:
TA-AHSCPCB2-0
Code site:
990
Libellé évènement:
Appel à la passerelle par une application cliente
_id:
boHajWsBUHuXczI-WtZr
_type:
_doc
_index:
monbeaunode_1
_score:
1
Here is my config :
filter
{
csv
{
separator => ","
columns => ["Date et heure","Utilisateur","Code","Libelle evenement","Code retour","Application","Code site","Type de table","Objet Start","Usage cache","Valeur avant modif","Valeur apres modif","SDT"]
}
mutate{
convert => {
"Date et heure" => "string"
"Utilisateur" => "string"
"Code" => "integer"
"Libellé évènement" => "string"
"Code retour" => "string"
"Application" => "string"
"Code site" => "integer"
"Type de table" => "string"
"Objet Start" => "string"
"Usage cache" => "string"
"Valeur avant modif" => "string"
"Valeur après modif" => "string"
"SDT" => "string"
}
#Gestion des accents
rename => { "Libelle evenement" => "Libellé évènement"
"Valeur apres modif" => "Valeur après modif" }
#Suppression des carriage returns(\r) du dernier champs
gsub => [ "message", "[\r]", "" ]
}
#date { match => [ "Date et heure", "dd/MM/YYYY HH:mm" ] }
}
MAPPING :
PUT monbeaunode_1/_mapping
{
"properties":{
"Date et heure":{
"type":"date",
"format" : "dd/MM/YYYY HH:mm"
},
"Utilisateur":{
"type":"keyword"
},
"Code":{
"type":"keyword"
},
"Libellé évènement":{
"type":"keyword"
},
"Code retour":{
"type":"keyword"
},
"Application":{
"type":"keyword"
},
"Code site":{
"type":"keyword"
},
"Type de table":{
"type":"keyword"
},
"Objet start":{
"type":"keyword"
},
"Usage cache":{
"type":"keyword"
},
"Valeur avant modif":{
"type":"keyword"
},
"Valeur après modif":{
"type":"keyword"
},
"SDT":{
"type":"keyword"
}
}
}