Use log timestamp

Roberto_Iglesias · September 23, 2016, 7:02pm

Hi
I'm trying to use my log's timestamp but this is not working.
My filter:

date {
    match => ["realtimestamp", "MMM DD HH:mm:ss"]
    target => "@timestamp"
}

And the result:

"message" => "Sep 18 05:59:24"
"@timestamp" => "2016-01-18T08:59:24.000Z",
"real_timestamp" => "Sep 18 05:59:24",

Where is the mistake?

warkolm · September 25, 2016, 6:12am

Why is it not working? What are you expecting?

magnusbaeck · September 25, 2016, 7:27pm

What's your timezone? If it's UTC+3 things are working just fine.

Roberto_Iglesias · September 26, 2016, 11:40am

So, the time is fine, but the date? It's not supposed that show me "2016-09-18" instead of "2016-01-18"?
Sorry for the ignorance

magnusbaeck · September 26, 2016, 12:54pm

Ah, right. The problem is your use of "DD" instead of "dd" in the date pattern.

Roberto_Iglesias · September 26, 2016, 1:19pm

You are goddamn right.
Citation needed:n