I have logs that are read after the fact and I need to enter them on my timeline as the events occured not as the logs are read by my shippers. Log entries look like this:
2018-05-18 01:07:03 - Nagios XI [32] system:localhost - cmdsubsys: User [abcdef01] applied a new configuration to Application subsys
In my logstash conf file I believe I've isolated the datestamp and now just need to convert it to epoch
Thanks Magnus, now I've got most of what I need with this configuration.
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} ?%{GREEDYDATA:message}" }
overwrite => ["message"]
}
date {
locale => "en"
match => ["timestamp", "yyyy-MM-dd HH:mm:ss"]
target => "@timestamp"
}
}
How do I add a field with the time in epoch format ... same time as timestamp.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.