Want to capture timeStamp without milliseconds

(Saket Kumar) #1

The CSV contains timeStamp field whose format is "yyyy/MM/dd HH:mm:ss.SSS"
I want to capture only "yyyy/MM/dd HH:mm:ss"

Used below config but it didn't work.

filter {
if ([message] =~ "responseCode") {
drop { }
} else {
csv {
separator => ","
columns => ["timeStamp", "elapsed", "label", "responseCode", "responseMessage", "threadName", "dataType", "success", "bytes", "grpThreads", "allThreads", "URL", "Latency", "Encoding", "SampleCount", "ErrorCount", "Hostname", "IdleTime"]
date { match => ["timeStamp", "yyyy/MM/dd HH:mm:ss.SSS", "yyyy/MM/dd HH:mm:ss"]}


Ignore date offset in logstash
(Magnus Bäck) #2

Use a mutate filter (specifically its gsub parameter) to strip the milliseconds from the timestamp field before you feed it to the date filter.

(Saket Kumar) #3

Do you mean below to be done?
mutate {
gsub => ["timestamp", ".\d{3}", ""]

(Saket Kumar) #4

I get following error:

←[33mFailed parsing date from field {:field=>"timeStamp", :value=>"2015/07/10 05:52:04.586"

I configured as:
mutate {
gsub => ["timeStamp", ".\d{6}", ""]
date { match => ["timeStamp", "yyyy/MM/dd HH:mm:ss"]}

(Magnus Bäck) #5

Periods are metacharacters in regular expressions so you need to escape them, you should anchor the match to the end of the string, and finally you should expect three digits and not six (six digits would be for microseconds). Hence:

gsub => ["timeStamp", "\.\d{3}$", ""]

(Saket Kumar) #6


(system) #7