#logstash

Hello everyone, i am struggling a bit at defining a proper match for a date filter, this is how the @timestamp looks like -> 2014-07-31T12:32:06.834Z

how should i define the capital "T" in joda time format ?

@Sir_Michael that is simply ISO8601 format

strange, i included that one in my array

match => [ "logdate", "MMM dd YYY HH:mm:ss",

"MMM d YYY HH:mm:ss", "ISO8601" ]

match => [ "logdate", "MMM dd YYY HH:mm:ss",

"MMM d YYY HH:mm:ss", "ISO8601" ]

match => [ "logdate", "ISO8601"] should work fine

then sth else is wrong

do i have to add "logdate" to a field afterwards ?

i'm trying an exmaple, hold

ok

@Sir_Michael, filter works fine; see this; http://pastebin.com/j4ZV6Vqx

Title: /opt/logstash/bin/logstash -f test.conf foo Failed parsing date from field {:fi - Pastebin.com (at pastebin.com)

config file: http://pastebin.com/A40SPp9G

Title: input { stdin { type => 'stdin-type' } } filter { date { match => ['m - Pastebin.com (at pastebin.com)

@efontana thx, looks like my time filter is working, as it seems i have to add more grok patterns for several devices :(