"UNIX_MS" Syntax in Date Plugin

Elastic Stack Logstash
1

How should I use the "UNIX_MS" Syntax in Date Plugin? Below is what I've tried and it does not work. I cannot find any examples of this online.

    date 
    {
        match => [ "my_field", "MMM dd YYY HH:mm:ss", "MMM  d YYY HH:mm:ss", "ISO8601", "UNIX_MS"     ]
    }
2

What's the contents of my_field? What's the current result from the filter? What was your expectation?

3

part of my log has "my_field=1366125127000"

4

Sure, but do you actually have a field named my_field? Please show the output of a stdout { codec => rubydebug } plugin.

5

Output of stdout { codec => rubydebug } has the following.

"my_field" => "1366125117000\r",

6

The trailing carriage return character might be the problem. Try using the mutate filter's strip option to remove it so that my_field just contains the timestamp integer.

7

the "\r" is the problem.

problem solved