Testing the following with stdin input and stdout output works fine, i.e. the timestamp is matched and put in @timestamp:
input { stdin { } }
filter {
grok {
match => ["message", "%{TIMESTAMP_ISO8601:tstamp}"]
}
date {
match => ["tstamp", "ISO8601"]
}
}
output { stdout { codec => rubydebug } }
However, I get " _grokparsefailure" when I change to redis input and elasticsearch output:
input {
redis {
host => "redis"
data_type => "list"
key => "my-test"
}
filter {
grok {
match => ["message", "%{TIMESTAMP_ISO8601:tstamp}"]
}
date {
match => ["tstamp", "ISO8601"]
}
}
output {
elasticsearch {
hosts => ["elasticsearch-host:9200"]
index => "my-test"
}
}
I'm testing with this string:
{"@timestamp":"2017-01-18T11:41:28.753Z","source":"host1","level":"INFO","message":"Some log event"}