Please show us an example event. Use a stdout { codec => rubydebug } output.
timestamp and @timestamp does not have same value
Why would they have the same value when you've configured the date filter to store the parsed timestamp into the timestamp field, leaving @timestamp untouched?
date {
target => "eventtimestamp"
match => [ "eventtimestamp", "yyyy-MM-dd HH:mm:ss.sssZ", "ISO8601" ]
timezone => "UTC"
}
Now, the expectation is this new field will be a date field that I can use in Kibana, but this field is coming as string. Can you please take a look at my code and tell me what I am doing wrong here?
Now, the expectation is this new field will be a date field that I can use in Kibana, but this field is coming as string. Can you please take a look at my code and tell me what I am doing wrong here?
Is the date filter successful? What does an event look like? What probably happened here is that you sent a document to ES with a eventtimestamp value not being parseable as a date, so it was mapped as a string. Since the mapping of a field can't be changed after the fact for a particular index it made no difference that subsequent documents may have had eventtimestamp fields that would've been recognized as dates. Unless you have precious data in the index just delete it and run Logstash again to index new data.
This is another reason why it's a good idea to only enable the elasticsearch output once you've verified with e.g. a stdout output that things are working.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.