elasticsearch - Syslog timestamp without year? -

i backfilling logs elasticsearch. creating index log date in it's timestamp, use date filter this:

date {                 "locale" => "en"                 match => ["timestamp", "mmm  d hh:mm:ss", "mmm dd hh:mm:ss", "iso8601"]                 target => "@timestamp"         } 

i using logs syslog, , syslog timestamp format doest not have year:

# syslog dates: month day hh:mm:ss syslogtimestamp %{month} +%{monthday} %{time} 

so after using date filter, index created logstash-2015.12.26 if reading log of 26th dec 2014. since timestamp not available in log, it's picking current year default.

any idea how make correct index?

absent year in string being parsed joda time, logstash defaults year logstash process started. see github.com/logstash-plugins/logstash-filter-date bug #3. temporary workaround, add temporary filter append correct year (2014) end of timestamp field , adjust date filter pattern include yyyy.

filter {   mutate {     replace => ["timestamp", "%{timestamp} 2014"]   }   date {     locale => "en"     match => ["timestamp",               "mmm  d hh:mm:ss yyyy",               "mmm dd hh:mm:ss yyyy",               "iso8601"]   } }