Why does the replacement @timestamp fail？

[wajika]

The index pattern was created without any timestamp.

filter {
    date {
      match => ["[CreationTime]","yyyy-MM-dd HH:mm:ss.SSS"]
      timezone => "Asia/Shanghai"
      target => "@timestamp"
    }
}
mutate {
  replace => [ "@timestamp", "%{CreationTime}" ]
}

The result is not right.

[Badger]

@wajika

"yyyy-MM-dd HH:mm:ss.SSS"

Looks to me like there are two spaces. Try

"yyyy-MM-dd  HH:mm:ss.SSS"

[wajika]

Even if I use "yyyy-MM-dd HH:mm:ss.SSS", it still fails.
@Badger

[Badger]

Your [CreationTime] field does not have a sub-second part. The date filter pattern must exactly match the field. Try

"yyyy-MM-dd  HH:mm:ss"

[wajika]

I have tested it before and it was not successful.

date {
match => ["[CreationTime]","yyyy-MM-dd HH:mm:ss","ISO8601"]
timezone => "Asia/Shanghai"
target => "@timestamp"
}

Is there any way to debug the date plugin?

[kavierkoo (Kavier)]

Try

    date {
        match => ["yyyy-MM-dd HH:mm:ss","yyyy-MM-dd  HH:mm:ss","ISO8601"]
        timezone => "Asia/Shanghai"
        target => "@timestamp"
    }