LogStash日期过滤器错误

Question

I've just upgraded from 5.2 to 5.6 in my test environment.

After the upgrade my logstash filter for date stopped working.

I'm getting a date of "Sep 26 11:01:41" and matching on

"match => [ "syslog_timestamp", "MMM dd HH:mm:ss" ]"

it throws

JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unrecognized token 'Sep': was expecting ('true', 'false' or 'null')

Answer 1

You have one too many spaces in your pattern "MMM dd HH:mm:ss" should be "MMM dd HH:mm:ss"

"match => [ "syslog_timestamp", "MMM dd HH:mm:ss" ]"
                                    ^
                                    |
                                   here

Answer 2

I have found an issue on your log

  input {
     beats {
        port => 5044
       ssl => true
       ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
       ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
       codec => json
      }
}

try remove the

codec => json

seems the input data is not json format ,just remove it and try