4

I'm parsing Nginx logs into logstash with the following config:

input { stdin { type => "nginx"}}

filter {
    grok {
        type => nginx
        pattern => "%{COMBINEDAPACHELOG}"
    }
    date {
        type => nginx
        match => [
            "timestamp",
            "dd/MMM/YYYY:HH:mm:ss Z"
        ]
    }
 }

 output { stdout { debug => true debug_format => "ruby"}}

Except here's the problem: when I pass in a log with a @timestamp of "04/Sep/2012:12:44:16 -0500" I get (as the result timestamp) "2013-09-04T17:44:16.000Z". Wrong year. Is this a bug?

Brian Hicks
  • 185
  • 1
  • 8

1 Answers1

1

From the documentation as linked to from logstash documentation you've picked the wrong syntax in your date filter. Try using yyyy (year) instead of YYYY (year of era), I believe that should correct the issue you are reporting.

I hope that helps!

Rumbles
  • 994
  • 1
  • 12
  • 28