Try to add a new field with timestamp in logstash

Elastic Stack Logstash
1

Hi everyone,

I am pretty new in ELK world and I would like to parse csv file with logstash.
I have tried to add a time field with timestamp (YYYY MM DD format), but I think there is an issue in the format
I have made this conf

input {
  file {
    path => "/xxx/xxx/xxxx/data/devboard.csv"
    start_position => "beginning"
  }
}

filter {
      csv {
        columns => [ "ID de tâche", "Nom de tâche", "Nom du compartiment", "Progression","Priorité","Attribué à","Créé par","Date de création","Date de début","Date d’échéance","En retard","Date de fin","Exécuté par","Description","Éléments de la liste de contrôle effectués","Éléments de la liste de contrôle","Étiquettes"
]
        add_field => { "date_insert" => "%{@timestamp}" }
}

      date{
        match => ["timestamp", "dd/MM/yyyy"]
        timezone => "UTC"
}
}

output {
  elasticsearch {
  hosts => ["xx.xx.xx.xx:xxx"]
  index => "devboardtest"
  user => "_xxx"
  password => "xxx"
  }
}

And find below the logs:

[2021-04-28T12:42:50,571][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"input\", \"filter\", \"output\" at line 6, column 1 (byte 132) after ", :backtrace=>["/apps/logstash/logstash-7.10.2/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:184:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/apps/logstash/logstash-7.10.2/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/apps/logstash/logstash-7.10.2/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/apps/logstash/logstash-7.10.2/logstash-core/lib/logstash/agent.rb:365:in `block in converge_state'"]}

Thanks for your help

David

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.