Logstash filter timestamp from a log message

Question

I follow the Logstash tutorial and create the following configuration file for test purposes:

input {
  file {
    path => "C:\Dev\sample.log"
    start_position => beginning
  }
}
filter{
    date {
        match => [ "logdate", "YYYY-MM-dd HH:mm:ss,SSS" ]
    }
}
output {
  elasticsearch { host => localhost
                  index => "test"
                }
  stdout { codec => rubydebug }
}

However, the only fields that are displayed are: "message", "@ version", "@timestamp", "host" and "Path".

No "logdate". I searched for a while, and I saw that people having the same problem were setting the wrong date format, but I checked mine with "Joda-Time" as recommended by the Logstash tutorial. Thank you for your help.

Answer 1

I managed to get the result that I was looking for by doing the following:

    input {
  file {
    path => "C:\Dev\sample.log"
    start_position => beginning
  }
}
filter{
    grok {
       match => [ "message", "%{TIMESTAMP_ISO8601:logdate}" ]
    }       
    date {
        match => [ "logdate", "YYYY-MM-dd HH:mm:ss,SSS"]
    }
}
output {
  elasticsearch { host => localhost
                  index => "test"
                }
  stdout { codec => rubydebug }
}

, , , - . , ( ) ( ) ? , - - . !

Answer 2

, logstash, :

- . regex, . : " - " .. , , ( ). .

, , grok , , .