-1

my date which is in below format

"_messagetime" => "08/08/2022 22:18:17.254 +0530"

I am using date filter in my logstash

date {
    match => ["_messagetime", "YYYY-MM-dd HH:mm:ss.SSS"]
}

but I am getting

"_dateparsefailure"

Can anyone plz suggest what might be wrong with my approach

rohit saraf
  • 37
  • 1
  • 8

2 Answers2

2

The date filter must match the entire value of the field. It cannot just parse a prefix. Also, your date filter has YYYY-MM-dd, but your field has dd/MM/YYYY.

You can parse that field using

date { match => ["_messagetime", "dd/MM/YYYY HH:mm:ss.SSS Z"] }

to get "@timestamp" => 2022-08-08T16:48:17.254Z. Note the trailing Z in the value of [@timestamp] -- all timestamps in logstash are stored in Zulu / UTC timezone.

Badger
  • 3,943
  • 2
  • 6
  • 17
0

your error it's caused by the " +0530" string in the _messagetime field content.

To fix this, one option is :

  • Remove this string before the date plugin, you can do this with use of grok or dissect

For example :

filter {
  grok {
    match => { "_messagetime" => "%{DATESTAMP:newdate}%{DATA:trash}" }
  }
}
  • Apply the same date plugin conf wich must work on new content now without " +0530" occurence
YLR
  • 1,503
  • 4
  • 21
  • 28