TimeStamp Off by a month_Help


(harsha) #1

I am trying to parse "20170201 00:54:24 GMT-0600" field from logline and convert it to the @timestamp. I designed a data filter which looks like this "YYYYMMDD HH:mm:ss zZ" but the output becomes 2017-01-01T07:02:01.000Z...can someone please assist me with this?

date {
match => ["SetupTimestamp", "YYYYMMDD HH:mm:ss zZ"]
locale => en
}


(Magnus B├Ąck) #2

Use YYYYMMdd, not YYYYMMDD.


(harsha) #3

Yep, thats the one.. Worked well once i changed it to dd. Really appreciate .

thanks


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.