Date pattern doesn't work as expected in logstash

Question

I am trying to use following date filter to convert string to date but it doesn't seem to be working.

Sample input data(string) - Mon Jan 20 09:20:35 GMT 2020

I am first using a mutate gsub to remove GMT which renders following string output- Mon Jan 20 09:20:35 2020

My gsub mutate filter looks like this -

mutate { gsub => [ "TimeStamp", "GMT", "" ] }

Now, I am using a date filter to convert gsub output to date format but it doesn't seem to be working-

date {
match => [ "TimeStamp", "EEE MMM dd HH:mm:ss  yyyy" ]
target => "TimeStamp"
locale => "en"
}

I have also tried following with no success-

date {
match => [ "TimeStamp", "EEE\sMMM\sdd\sHH:mm:ss\s+yyyy" ]
target => "TimeStamp"
timezone => "Etc/GMT"
locale => "en"
}

Answer 1

The date pattern should be

MMM dd HH:mm:ss yyyy

Maybe you have to add some extra spaces before the year (looks like you have them in your logs).

Instead of EEE (name of weekday abreviated) you need to use MMM (name of month abreviated).