Timestamp problem created using dissect

Elastic Stack Logstash
21

I changed the first solution (we were referring to) to be:

mutate
{
  convert => { "acme.date" => "string" }
}

and it still does not convert acme.date from type date to string which strikes me as very odd since mutate/convert is documented as a working feature. It seems pointless to have such a feature if it doesn't work (which is my backward way of asking, rhetorically, why it does not). Clearly, the dissect clause is doing its job perfectly.

Note that, however unrelated and irrelevant, remove_field works:

filter
{
  dissect
  {
    mapping =>
    {
      "message" => "%{acme.date} %{acme.time} CEF:%{acme.version}|%{acme.device_vendor}|%{acme.device_product}|%{acme.device_version}|%{acme.device_event_class_id}|%{acme.name}|%{acme.severity}|%{acme.extensions}"
    }
    remove_field => [ "message" ]
  }
}

This removes the superfluous message field after the new, split-out fields have been created.

22

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.