筛选日期Logstash

Question

I just started with Logstash parsing a CSV document. CSV document only has two columns "Date" and "High". I have read various configurations to parse a date but I can not, giving me error in that field. The date has the format DD / MM / YYYY and error tells me the following:

Failed parsing date from field {:field=>"Date", :value=>"Date", :exception=>"Invalid format: \"Date\"", :config_parsers=>"dd/MM/YYYY", :config_locale=>"default=es_ES", :level=>:warn}

This is my configuration file to filter Logstash:

input {
  file {
    path => "/path/to/data.csv"
    start_position => "beginning"    
  }
}

filter {
  csv {
      separator => ","
      columns => ["Date","High"]
  }

  date{
     match => [ "Date", "dd/MM/YYYY" ]
  }

  mutate {convert => ["High", "float"]}

}

output {  
    elasticsearch {
        hosts => ["localhost:9200"]
    action => "index"
    index => "machine"
    workers => 1
    }
    stdout { codec => rubydebug }
}

Thank you!!

Answer 1

In your date plugin try to change the letter cases in the match setting. Something like this:

  date{
      match => [ "Date", "DD/MM/YYYY" ]
  }

If not helping try to make them all lowercase.

Answer 2

The format string dd/MM/yyyy should work. You can find detailed specifications for formatting strings in the JodaTime documentation .