Use parsed date/time fields to prepare @timestamp

[Saurabh_Jinturkar]

Hi,

I am trying to parse HAProxy logs in Logstash. I am using standard pattern available here to parse the log. Filter is parsing date however, I want to use those fields to create a timestamp for the log.

Do I need to use date filter plugin or is it possible through something else? Any pointers on this are welcome.

Thank you!

[MariumHassan]

Hi,

you can use date filter plugin if you want to use your field to create a timestamp for your logs.

filter {
  date {
    match => [ "logdate", "MMM dd yyyy HH:mm:ss" ]
  }
}

It stores the matching timestamp into the @timestamp field of the event if the target field is not provided.

[Saurabh_Jinturkar]

Thanks for the help!

Can I combine already parsed fields? For example, HAProxy pattern matches and creates fields year, monthday, month, hour, minutes and second. I just want to combine them to form the date since they are already matched.

[Badger]

Yes, you can use add_field in most filters and use sprintf notation to reference field values to insert.