This works for me..
[code]input
{
file {
path => "C:\logs\InteractionWorkspace\TEST.txt"
start_position => "beginning"
ignore_older => 0
}
}
filter {
grok {
match => ["message", "^%{TIME:timestamp}"]
}
date {
match => [ "timestamp" , "HH:mm:ss.SSS" ]
target => "@timestamp"
locale => "en"
timezone => "UTC"
}
}
output
{
stdout { codec => rubydebug }
file {
codec => line {
format => "%{[time]} | %{[severity]} : /%{[thread]}/ %{[loggername]} %{[timestamp]} (%{[sourcemethodname]}) %{[timestamp]} - %{[message]} PETE: %{[timestamp]}"
}
path => "C:\logs\%{host}\PETE-%{+YYYY-MM-dd}.log"
}
}[/code]
Test.txt:
[code]10:00:18.307 Int 22000 ##### Did you see this one??
10:00:18.307 Int 22000 ##### Did you see this one???[/code]
Console Output:
[code]{
"path" => "C:\\logs\\InteractionWorkspace\\TEST.txt",
"@timestamp" => 2017-01-01T10:00:18.307Z,
"@version" => "1",
"host" => "xxxxx",
"message" => "10:00:18.307 Int 22000 ##### Did you see this one??\r",
"timestamp" => "10:00:18.307"
}
{
"path" => "C:\\logs\\InteractionWorkspace\\TEST.txt",
"@timestamp" => 2017-01-01T10:00:18.307Z,
"@version" => "1",
"host" => "xxxxxx",
"message" => "10:00:18.307 Int 22000 ##### Did you see this one???\r",
"timestamp" => "10:00:18.307"
}[/code]
The date part of the @timestamp defaults to the first day of the year because there is no date in your log file timestamp.
