<NME> date.rb
<BEF> ADDFILE
<MSG> - Start using our own logger
- Add LogStash::Time::to_iso8601 to convert DateTime objects to iso8601 format.
- Add a 'date' filter for using a specific field into the real timestamp for
  the event. Example
    filters:
    - date:
        linux-syslog:
          date: %b %e %H:%M:%S
        apache-access:
          timestamp: "%d/%b/%Y:%H:%M:%S %Z"
  Syntax is:
    <tag>:
       <field>: <format>
  Supported format is 'strftime'



<DFF> @@ -0,0 +1,57 @@
+require "logstash/namespace"
+require "logstash/time"
+require "logstash/logging"
+
+class LogStash::Filters::Date
+  # The 'date' filter will take a value from your event and use it as the
+  # event timestamp. This is useful for parsing logs generated on remote
+  # servers or for importing old logs.
+  #
+  # The config looks like this:
+  #
+  # filters:
+  #   date:
+  #     tagname1:
+  #       <fieldname>: <format>
+  #     tagname2:
+  #       <fieldname>: <format>
+  def initialize(config = {})
+    @config = config
+    @tags = Hash.new { |h,k| h[k] = [] }
+    @logger = LogStash::Logger.new(STDERR)
+  end # def initialize
+
+  def register
+    @config.each do |tag, tagconfig|
+      @tags[tag] << tagconfig
+    end # @config.each
+  end # def register
+
+  def filter(event)
+    return unless event.include?("tags")
+    event["tags"].each do |tag|
+      next unless @tags.include?(tag)
+      @tags[tag].each do |tagconfig|
+        tagconfig.each do |field, format|
+          #if event.include?(field) or (event["fields"].include?(field) rescue false)
+            #value = (event[field] or event["fields"][field])
+          if (event["fields"].include?(field) rescue false)
+            fieldvalue = event["fields"][field]
+            #fieldvalue = [fieldvalue] if fieldvalue.is_a?(String)
+            @logger.info fieldvalue
+            fieldvalue.each do |value|
+              #value = event["fields"][field]
+              begin
+                time = DateTime.strptime(value, format)
+                event["timestamp"] = LogStash::Time.to_iso8601(time)
+                @logger.debug "Parsed #{value.inspect} as #{event["timestamp"]}"
+              rescue => e
+                @logger.warn "Failed parsing date #{value.inspect} from field #{field} with format #{format.inspect}. Exception: #{e}"
+              end
+            end # fieldvalue.each 
+          end # if this event has a field we expect to be a timestamp
+        end # tagconfig.each
+      end # @tags[tag].each
+    end # event["tags"].each
+  end # def filter
+end # class LogStash::Filters::Date

- Start using our own logger - Add LogStash::Time::to_iso8601 to convert DateTime objects to iso8601 format. - Add a 'date' filter for using a specific field into the real timestamp for   the event. Example     filters:     - date:         linux-syslog:           date: %b %e %H:%M:%S         apache-access:           timestamp: "%d/%b/%Y:%H:%M:%S %Z"   Syntax is:     <tag>:        <field>: <format>   Supported format is 'strftime'