shagun
(Shagun)
August 1, 2019, 11:25am
1
I have a date in this format
"event_time" : "2019-07-02 19:23:59+0000"
and need to parse it in the format of @timestamp that is
"@timestamp" : "2019-08-01T11:18:34.890Z"
This is my filter :
date {
match => [ "event_time", "yyyy-MM-dd'T'HH:mm:ss'.'SSS'Z'" ]
locale => en
timezone => "UTC"
target => "event_time"
}
but unable to parse.
Help me with suggestions.
Badger
August 1, 2019, 12:20pm
2
That does not match your field format. Try
date { match => [ "event_time", "yyyy-MM-dd HH:mm:ssZ'" ] }
1 Like
shagun
(Shagun)
August 2, 2019, 11:29am
3
Oh Okay! I got it what to match here in "match" field. I was assuming it wrong.
Thanks
system
(system)
Closed
August 30, 2019, 11:33am
4
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.