String to date type

Hi,
I want to change my test_log_time field type from String to date and when I start Logstash it shows it's okay but Kibana still shows String even if I refresh the page.
my config file:

input {
beats {
port => "5044"
}
}
filter {
if "asd123" in [tags] {
dissect {
mapping => {
message => '%{log_timestamp} %{+log_timestamp} %{s-ip} %{cs-method} %{cs-uri-stem} %{cs-uri-query} %{s-port} %{cs-username} %{c-ip} %{cs-user-agent} %{cs-referer} %{response} %{sc-substatus} %{sc-win32-status} %{time-taken}'
}
}
}
else if "apache" in [tags] {
dissect {
mapping => {
message => '%{}"%{}":"%{clientip} %{} %{} [%{timestamp}] "%{verb} %{request} %{}" %{response} %{bytes}%{}","%{}":"%{}","%{}":"%{}"%{}'
}
}
}
else if "test" in [tags] {
dissect {
mapping => {
message => '%{test_log_time} %{+test_log_time} %{packet_persec} %{diff}'
}
}
date {
match => ["test_log_time","yyyy-MM-dd HH:mm:ss"]
}
}
}
output {
elasticsearch {
hosts => [ "localhost:9200" ]
user => ----------
password => ---------
}
stdout { codec => rubydebug }
}

my example log:

2019-05-23 10:22:24 702281827 905

This will parse the value of test_log_time and store the resulting Logstash::TimeStamp in @timestamp. If you want to overwrite test_log_time then specify the target option to the date filter.

Thank you, it works!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.