Try Using mutate for timestamp field

Continuing the discussion from Error to map date field with format yyyy-MM-dd HH:mm:ss.SSS:

//
mutate {
gsub => [
# replace all space with T in timestamp field/column
"timestamp", " ", "T"

]

//

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.