Hi, i have added a new time field for my log parser and there is a time difference of 2:30 in time that is recorded in ES and the log time. PFA.
grok { match => { "message" => "%{TIMESTAMP_ISO8601:time} \[%{DATA:pool}\] %{DATA:metric} %{DATA:metricname} %{DATA:datatype} %{NUMBER:metricvalue:float} %{GREEDYDATA:unit}" } }
date { match => [ "time" , "ISO8601", "yyyy-MM-dd HH:mm:ss.SSS" ]
target =>"time" }