Hi,
I am trying to match the log event timestamp with OpenSearch @timestamp value. It has difference in minutes. My log format is as below -
xx.xx.xxx.xxx 10.48.11.36 - - [25/Apr/2024:09:08:16 +0000] "POST /api/x/x/9e309077033/poll HTTP/1.1" 200 12 "-" "python-requests/2.31.0"
- 127.0.0.1 - - [25/Apr/2024:09:08:55 +0000] "GET /api/x/x HTTP/1.1" 401 156 "-" "curl/7.88.1"
For the first log @timestamp value is: Apr 25, 2024 @ 09:08:59.815
The second log @timestamp value is: Apr 25, 2024 @ 09:08:58.825
This is the config I am trying, but in output I always get the current timestamp rather than the value of event “timestamp”.
dissect {
mapping => {
"message" => '%{client_ip} %{+client_ip} %{?-} %{?-} [%{timestamp}] %{method} %{path} %{http_version} %{response} %{bytes} %{url} %{browser}'
}
}
date {
match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss ZZZ" ]
target => "@timestamp"
}
Someone guide me to right direction.
Thanks