how to map a message likes "09Mar21 15:58:54.286667" to a timestamp field in filebeat?

Question

I want to map a message likes "09Mar21 15:58:54.286667" to a timestamp field in filebeat but I don't know how to do ?

1 My current filebeat is filebeat-7.10.0-windows-x86_64, how to do it?

2 from https://www.elastic.co/guide/en/beats/filebeat/current/processor-timestamp.html the layout is supported in 8.0 , is it necessary to upgrade to 8.0 ? how to define the layout in 8.0 to map the format likes "09Mar21 15:58:54.286667"

Thanks a lot !

Answer 1

TLDR;

You can use the following pattern: 02Jan06 15:04:05.000000

To understand

All the *beats (metricbeat, filebeat, ...) family is written in Golang. So you will need to provide a pattern specific to Golang to parse this date string.

Golang offer a somewhat surprising way to handle date/time format.

It is based on a specific date, (The 2nd of January 2006 at 3:05:05 PM). You are to use this reference time an put it to you desired format.

In your specific case

-> 02Jan06 15:04:05.000000

You can try it out with the following snippet

package main
import ("fmt"
        "time")

func main() {
    var t = "09Mar21 15:58:54.286667"

    var t2, err = time.Parse("02Jan06 15:04:05.000000", t)
    
    fmt.Println(t, t2, err)
}