Thank you Jenni for the info. I have tried but getting below error. Can you please advise anything is missing in the code
Error
[2018-04-24T09:43:48,356][ERROR][logstash.filters.ruby ] Ruby exception occurred: no implicit conversion of Fixnum into String
[2018-04-24T09:43:48,356][ERROR][logstash.filters.ruby ] Ruby exception occurred: no implicit conversion of Fixnum into String
[2018-04-24T09:43:48,357][ERROR][logstash.filters.ruby ] Ruby exception occurred: no implicit conversion of Fixnum into String
Code
grok {
match => ["BusinessDate", "%{YEAR:year}%{MONTHNUM:month}%{MONTHDAY:day}"]
overwrite => ["message"]
}
if "_grokparsefailure" in [tags] {
mutate {
remove_tag => ["_grokparsefailure"]
}
}
# Set Timestamp
mutate {
add_field => {
ExpectedTime => "03:00:00:000"
}
}
mutate {
add_field => {
BusinesDateTime => "%{year}-%{month}-%{day} %{ExpectedTime}"
}
}
#Not required ExptectedTime in output
mutate {
remove_field => [ExpectedTime]
}
#Convert to Date
date
{
match => ["BusinesDateTime", "YYYY-MM-DD HH:mm:ss.SSS"]
}
#Adding one day to BusinessDateTime
ruby {
code => 'event.set("BusinesDateTime", LogStash::Timestamp.new(event.get("BusinesDateTime")+86400))'
}