{"action":"created","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/issues/9","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/issues/9/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/issues/9/events","html_url":"https://github.com/logstash-plugins/logstash-filter-date/issues/9","id":56822756,"number":9,"title":"Multiple input fields to 1 date","user":{"login":"jsvd","id":31809,"avatar_url":"https://avatars.githubusercontent.com/u/31809?v=3","gravatar_id":"","url":"https://api.github.com/users/jsvd","html_url":"https://github.com/jsvd","followers_url":"https://api.github.com/users/jsvd/followers","following_url":"https://api.github.com/users/jsvd/following{/other_user}","gists_url":"https://api.github.com/users/jsvd/gists{/gist_id}","starred_url":"https://api.github.com/users/jsvd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsvd/subscriptions","organizations_url":"https://api.github.com/users/jsvd/orgs","repos_url":"https://api.github.com/users/jsvd/repos","events_url":"https://api.github.com/users/jsvd/events{/privacy}","received_events_url":"https://api.github.com/users/jsvd/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-06T15:08:06Z","updated_at":"2015-02-06T15:27:04Z","closed_at":null,"body":"migrated from https://logstash.jira.com/browse/LOGSTASH-1956\r\n\r\nFull text below:\r\n\r\nLets say I have 2 fields: date and time.\r\nWhen I try to match these with the date filter, it won't work.\r\n\r\n```\r\ndate { \r\n  match => [ \"date\", \"yyyy-MM-dd\", \"time\", \"HH:mm:ss.SSS\" ]\r\n}\r\n```\r\n\r\nAccording to lieter in IRC (thank you!) I can use the mutate filter to solve that by creating an artificial \"merged field\":\r\n```\r\nmutate { add_field => [\"bla\", \"%{date} %{time}\"] }\r\n```\r\nThis is a entirely unnecessary second step which further complicates the issue one has with malformed logs like:\r\n{DAY:day} {MONTH:month} {MONTHDAY:monthday} {TIME:time} {WORD:timezone} {YEAR:year}\r\nThis might be already possible and just undocumented: http://logstash.net/docs/1.3.3/filters/date#match\r\nI also tried to google it, but no success.\r\nThank you for listening.\r\n"},"comment":{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/issues/comments/73253358","html_url":"https://github.com/logstash-plugins/logstash-filter-date/issues/9#issuecomment-73253358","issue_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/issues/9","id":73253358,"user":{"login":"jsvd","id":31809,"avatar_url":"https://avatars.githubusercontent.com/u/31809?v=3","gravatar_id":"","url":"https://api.github.com/users/jsvd","html_url":"https://github.com/jsvd","followers_url":"https://api.github.com/users/jsvd/followers","following_url":"https://api.github.com/users/jsvd/following{/other_user}","gists_url":"https://api.github.com/users/jsvd/gists{/gist_id}","starred_url":"https://api.github.com/users/jsvd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsvd/subscriptions","organizations_url":"https://api.github.com/users/jsvd/orgs","repos_url":"https://api.github.com/users/jsvd/repos","events_url":"https://api.github.com/users/jsvd/events{/privacy}","received_events_url":"https://api.github.com/users/jsvd/received_events","type":"User","site_admin":false},"created_at":"2015-02-06T15:27:04Z","updated_at":"2015-02-06T15:27:04Z","body":"maybe I didn't carry the correct meaning when migrating the issue here\r\nthe idea is to add this feature.\r\n\r\nIsn't the add_field invoked after the filter has done it's work?\r\n"}}