Replace @timestamp with timestamp in my message - logstash

Elastic Stack Logstash
10

Where the <158> is coming from in this example I do not know.
You can update your grok pattern and match for this %{TIMESTAMP_ISO8601:timestamp} that will fill the timestamp variable.

So instead of this:

grok {
   match => { "message" => ["^{timestamp}"] }
}

You get this:

grok {
   match => { "message" => ["^%{TIMESTAMP_ISO8601:timestamp}"] }
}

Then your date match can look like this.

date {
    match => [ "timestamp", "yyyy-MM-dd HH:mm:ss" ]
    target => "@timestamp"
}

Hope this helps.

Paul.

1 Like