Hi , I have specific log in a file log: Tue May 2 03:54:22 2017 I use a grok filter to extract the timestamp into a field of its own called "datestamp" "datestamp" => "Tue May 2 03:57:00 2017 ", "@timestamp" => 2017-05-15T14:25:05.490Z, My filter here , {filter { date { match => ["datestamp" ,…

It looks like you have a trailing space in the datestamp field, which is not accounted for in the pattern. Correct the pattern used to extract this field and I do not see why it would not work.

Discuss the Elastic Stack

Timestamp => @timestamp

Elastic Stack Logstash

Christian_Dahlqvist (Christian Dahlqvist) May 17, 2017, 7:28am 13

I am referring to the space at the end off the string.

Topic		Replies	Views
Date Filter Logstash	11	2318	March 13, 2018
__dateparsefailure trying match date Logstash	2	457	October 14, 2017
_dateparsefailure mapping date and time to @timestamp field Logstash	3	333	May 26, 2021
Cannot parse logs with date filter Logstash	4	902	October 18, 2017
_dateparsefailure when trying to overwrite @timestamp Logstash	8	261	June 7, 2024

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Timestamp => @timestamp

Related topics