RFC3339 parsing issue

Question

I facing an issue for parsing RFC3339 can anyone help me
In statedump it is showing the time stamp like this

"ts": "2025-11-18T21:17:14.026+10:00"

the code i am using is

date {

match => ["ts", "RFC3339"]

target => "event.idm.read_only_udm.metadata.event_timestamp"

on_error => "date_parse_failed"

}

but i am getting error

"date_parse_failed": true

vaskenh · Answer

Hi ​@satya_saketh. In this scenario, does the parsing outcome change if you substitute that match line with one that is more explicit to the timestamp you are working with?Ie, what if you change the match line to this:Does the parsing logic succeed? If it does, there might be some small nuance between the timestamp you’re working with and the format that is expected by that built-in RFC3339 format.--Vasken  match => ["ts", "yyyy-MM-dd'T'HH:mm:ss.SSSZ"]

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded