I'm parsing Nginx logs into logstash with the following config:
input { stdin { type => "nginx"}}
filter {
grok {
type => nginx
pattern => "%{COMBINEDAPACHELOG}"
}
date {
type => nginx
match => [
"timestamp",
"dd/MMM/YYYY:HH:mm:ss Z"
]
}
}
output { stdout { debug => true debug_format => "ruby"}}
Except here's the problem: when I pass in a log with a @timestamp
of "04/Sep/2012:12:44:16 -0500" I get (as the result timestamp) "2013-09-04T17:44:16.000Z". Wrong year. Is this a bug?