Logstash 6.2.4 - match time does not default to current date

Question

I am using logstash 6.2.4 with the following config:

input {
  stdin { }
}


filter {
  date {
    match => [ "message","HH:mm:ss" ]
  }
}

output {
  stdout { }
}

With the following input:

10:15:20

I get this output:

{
       "message" => "10:15:20",
      "@version" => "1",
          "host" => "DESKTOP-65E12L2",
    "@timestamp" => 2019-01-01T09:15:20.000Z
}

I have just a time information, but would like to parse it as current date.
Note that current date is 1. March 2019, so I guess that 2019-01-01 is some sort of default ?

How can I parse time information and add current date information to it ?

I am not really interested in any replace or other blocks as according to the documentation, parsing the time should default to current date.

Answer 1

You need to add a new field merging the current date with the field that contains your time information, which in your example is the message field, then your date filter will need to be tested against this new field, you can do this using the following configuration.

filter {
    mutate {
       add_field => { "current_date" => "%{+YYYY-MM-dd} %{message}" }
    }
    date {
        match => ["current_date", "YYYY-MM-dd HH:mm:ss" ]
    }
}

The result will be something like this:

{
    "current_date" => "2019-03-03 10:15:20",
      "@timestamp" => 2019-03-03T13:15:20.000Z,
            "host" => "elk",
         "message" => "10:15:20",
        "@version" => "1"
}