Timestamp from filename

[SusantaBN (Susanta)]

I have a requirement to put the timestamp on log file name and subsequently extract the timestamp from filename and add as a field in the elastic search index.

e.g. file name: 2018-10-31_13-11-25.33.csv

My custom grok

SUS_DATE %{YEAR}-%{MONTHNUM}-%{MONTHDAY}_%{HOUR}-%{MINUTE}-%{SECOND}

Conf file contents
input{
file{
path =>"D:/ELK_Stack/data/DLS/HM/*.csv"
start_position =>"beginning"
}
}
filter{
grok {
patterns_dir => "./patterns"
match => ["path","D:/ELK_Stack/data/%{DATA:srvtyp}/%{DATA:srvloc}/%{SUS_DATE:dattim}.csv" ]
}
date {
match => ["dattim","YYYY-MM-dd_HH-mm-ss.SS"]
}

But I always get dattim in type text instead of date.

I work on windows OS. Any help to convert dattim to type DATE would be highly appreciated.

[tamara (Tamara Rosini)]

You have the wrong date format change the date filter from:

match => ["dattim","YYYY-MM-dd_HH-mm-ss.SS"]

to

match => ["dattim","yyyy-MM-dd_HH-mm-ss.SS"]

[SusantaBN (Susanta)]

Thanks a lot Tamara. Solution worked well.