Add caracter in logstash custom patterns

[Adixon_Diaz]

Hi comunity,

I want to add a caracter when i'm processing data with logstash, for example, add a space or : or -.

I mean, i have the next log

2021-07-29122715960
grok custom pattern: FECHACORTA ((?>\d\d){1,2}[./-]%{MONTHNUM}[/-]%{MONTHDAY})(?!<[0-9])%{HOUR:hora}%{MINUTE:minuto}(?:%{SECOND:segundos}):?%{INT:ms}

My idea, is to be able to convert from this 2021-07-29122715960 to 2021-07-29 12:27:15:960.

This happen because my log give to me that bad format.

Thanks

[aaron-nimocks]

If the end goal is to put into Elastic as a date then you can just use the Date Filter. This will convert it to UTC or Zulu timezone.

Test Conf

input { generator { lines => ['{ "old_timestamp": "2021-07-29122715960" }'] count => 1 codec => "json" } }
filter {
 date {
  match => [ "old_timestamp", "yyyy-MM-ddHHmmssSSS" ]
  target => "new_timestamp"
 }
}    
output { stdout { codec => json_lines } }

Output

{
    "new_timestamp": "2021-07-29T16:27:15.960Z",
    "old_timestamp": "2021-07-29122715960"
}

[Adixon_Diaz]

@aaron-nimocks

date {
  match => [ "old_timestamp", "yyyy-MM-ddHHmmssSSS" ]
  target => "new_timestamp"
 }

You totally right, works perfect.

Thanks