date filter not working to replace @timestamp

Description

I tried running the following

The original "ad_time" filed like "ad_time": "20140428 150509"
After filtering to timestamp: "@timestamp": "2014-04-28T07:05:11.404Z"

And I find "tags": [ "tsmatch" ]. It means the date filter works. But why it couldn't replace the timestamp?

Activity

Show:
Philippe Weber
April 28, 2014, 11:28 AM

You cannot trust the add_tag of the date filter in 1.4.0, it will be fixed in 1.4.1 (see for details)

Also I ran your config from a test case and the result is as expected, @timestamp remains in UTC but with the correct value from ad_time field

Result of bin/logstash rspec spec/support.rb

Vince Ng
April 30, 2014, 6:58 AM

Example record sent to output:

I still could not solve this problem. It was something wrong?

Philippe Weber
April 30, 2014, 9:02 AM

It is because logstash need the "full" reference to your field as documented in http://logstash.net/docs/1.4.0/configuration#fieldreferences
Can you please try with

Vince Ng
April 30, 2014, 9:12 AM

Excellent!! It works!! Thank you very much

Vince Ng
April 30, 2014, 9:14 AM

It is because logstash need the "full" reference to your field as documented in http://logstash.net/docs/1.4.0/configuration#fieldreferences
Can you please try with
match => ["[eventdata][ad_time]", "YYYYMMdd HHmmss"]

Assignee

Logstash Developers

Reporter

Vince Ng

Labels

Affects versions

Configure