Trouble matching timestamp

Elastic Stack Logstash
4

Is there anything special I need to put into the conf or logstash startup to get more debug output from the date parser?

No, it logs that at the default log level.

"system_date" => 2017-04-27T21:12:00.000Z,

Aha! The field isn't a string but already is a timestamp, and that's why the date filter fails. That's arguably a bug (I've filed Date filter fails to parse timestamps · Issue #95 · logstash-plugins/logstash-filter-date · GitHub) but there are a couple of workarounds that you can try:

  • In your SQL query, typecast the timestamp as a string.
  • Use a mutate filter's convert option to typecast the field to a string prior to the date filter.
  • Use a mutate filter to copy the timestamp into @timestamp and overwrite the existing value (use the replace option).