Where's the % coming from?

[mykael (Michael Clarke)]

I'm using the following to add an ingestion timestamp to my records:

  ruby {
     code => 'event.set("ingest_time", Time.now.strftime("%Y-%m-%d %H:%M:%S.%3"))'
  }

What I'm getting in my data, thought, is:

ingest_time 2020%-06-23 22:09:45.

Which is missing the milliseconds - does logstash not support the %3 token?

It also has an extra % after the year - which must be coming out of ruby as the % in the format string is after the hyphen ( %Y-%m... ).

Any ideas?

[Rahul_Kumar4 (Rahul Kumar)]

@mykael

Which is missing the milliseconds - does logstash not support the %3 token?

Try .%L instead of .%3 for the miliseconds part. Not sure where the % after the year comes from. Not getting that in Ruby interpreter.

[Badger]

@mykael

ruby {
     code => 'event.set("ingest_time", Time.now.strftime("%Y-%m-%d %H:%M:%S.%3"))'
  }

%L or %3N will produce 3 digits of sub-second precision. I do not get the % after the year in 7.8.0

"ingest_time" => "2020-06-23 12:45:02.274",