Learning Elastic Stack 6.0

Date filter

This plugin is used for parsing the date from the fields. This plugin is very handy and useful when working with time series events. By default, Logstash adds a @timestamp field for each event, representing the time it processed the event. But the user might be interested in the actual timestamp of the generated event rather than the processed timestamp. So, using this filter, one can parse the date/timestamp from the fields and then use it as the timestamp of the event.

We can use the plugin as follows:

filter {    date {    match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]         }}

By default, the date filter overwrites the @timestamp field, but this can be changed by providing an explicit target field, as shown in the following code snippet. ...