Use the log time and date in the timestamp

Elastic Stack Logstash
1

Hi, Im trying to use the date and time in the log as the timestamp in elastic.

this is part of the log

12/27/19 06:46:39

this is the grok and the date filter to use the log date and time to use in the timestamp
grok{
match => {"message" => "%{DATA:date} %{TIME:time}"}
}

    date {
            match => ["date time", "MM/dd/yy HH:mm:ss"]
            target => "@timestamp"
    }

how can I achieve this?

2

Use mutate+add_field with sprintf references to combine date and time into a single field, or else use the pattern definitions option on the grok filter to define a pattern that combines "%{DATE} %{TIME}".

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.