Home / server / Questions / 535264
In Process
Brian Hicks
Asked: 2013-08-31 14:19:20 +0800 CST

Logstash Date Has the Wrong Year?

  • 772

I'm parsing Nginx logs into logstash with the following config:

input { stdin { type => "nginx"}}

filter {
    grok {
        type => nginx
        pattern => "%{COMBINEDAPACHELOG}"
    }
    date {
        type => nginx
        match => [
            "timestamp",
            "dd/MMM/YYYY:HH:mm:ss Z"
        ]
    }
 }

 output { stdout { debug => true debug_format => "ruby"}}

Except here's the problem: when I pass in a log with a @timestamp of "04/Sep/2012:12:44:16 -0500" I get (as the result timestamp) "2013-09-04T17:44:16.000Z". Wrong year. Is this a bug?

logstash

1 Answers

  1. From the documentation as linked to from logstash documentation you've picked the wrong syntax in your date filter. Try using yyyy (year) instead of YYYY (year of era), I believe that should correct the issue you are reporting.

    I hope that helps!

    • 1