Unable to parse logstash date filter

Elastic Stack Logstash
1

Unable to parse logstash date filter
SOURCE = 2024-04-16 18:29:01.178 -0400
LOGSTASH = "start_time" => 2024-04-16T18:29:01.178Z,

LOGSTASH DATE FILTER

date{
     match => ["[start_time]" , "yyyy-MM-dd HH:mm:ss.SSSZ"]
     timezone => "America/Toronto"
     target => "@timestamp"
}
2

Since your source includes a timezone offset the timezone option on the date filter will be ignored.

input { generator { count => 1 lines => [ '{ "start_time": "2024-04-16 18:29:01.178 -0400" } }' ] codec => json } }

output { stdout { codec => rubydebug { metadata => false } } }
filter {
    date{
        match => ["[start_time]" , "yyyy-MM-dd HH:mm:ss.SSS Z"]
        timezone => "Europe/London"
        target => "@timestamp"
    }
}

produces

"@timestamp" => 2024-04-16T22:29:01.178Z,
"start_time" => "2024-04-16 18:29:01.178 -0400"
1 Like