logstash generate @timestamp from parsed message

Question

I have file containing series of such messages:

component+branch.job                                 2014-09-04_21:24:46   2014-09-04_21:24:49

It is string, some white spaces, first date and time, some white spaces and second date and time. Currently I'm using such filter:

filter {
  grok {
    match => [ "message", "%{WORD:componentName}\+%{WORD:branchName}\.%{WORD:jobType}\s+20%{DATE:dateStart}_%{TIME:timeStart}\s+20%{DATE:dateStop}_%{TIME:timeStop}" ]
  }
}

I would like to convert dateStart and timeStart to @timestamp for that message.

I found that there is date filter but I don't know how to use it on two separate fields.

I have also tried something like this as filter:

  date {
    match => [ "message", "YYYY-MM-dd_HH:mm:ss" ]
  }

but it didn't worked as expected.

Answer 1

Based on duplicate suggested by Magnus Bäck, I created solution for my problem. Solution was to mutate parsed data into one field:

mutate {
  add_field => {"tmp_start_timestamp" => "20%{dateStart}_%{timeStart}"}
}

and then parse it as I suggested in my question.

So final solution looks like this:

filter {
  grok {
    match => [ "message", "%{WORD:componentName}\+%{WORD:branchName}\.%{DATA:jobType}\s+20%{DATE:dateStart}_%{TIME:timeStart}\s+20%{DATE:dateStop}_%{TIME:timeStop}" ]
  }
  mutate {
    add_field => {"tmp_start_timestamp" => "20%{dateStart}_%{timeStart}"}
  }
  date {
    match => [ "tmp_start_timestamp", "YYYY-MM-dd_HH:mm:ss" ]
  }
}