Changing time zone format

Elastic Stack Logstash
1

i am using jdbc as input and http as output.

from jdbc i am getting date as "2017-01-02T12:35:44.000Z"
but in my http output date will be accept as "2017-01-02T12:35:44.000+07:00"

when i am checking inn database there not mentioned any timezone.But in output i am getting z

Ho w can i convert from "2017-01-02T12:35:44.000Z" to "2017-01-02T12:35:44.000+07:00" format.

Thanks in Advance......

2

Logstash uses the system timezone, so what is that set to on the host LS runs on?

3

Thanks Mark for your quick reply...

but in my http output accept only "2017-01-02T12:35:44.000+07:00" this format.

To remove z in my time format i am using below filter.

mutate {
gsub => [
"%{cycle_time}", "z", ""
]
}

But it's not working for me.My goal is to remove z.
you have working example of gsub or grok or with any other filter.

Please help me how can avoid z in my Time.

Thanks in Advance.....

4

The first element of the array you feed to gsub should contain the name of the field, not its contents (i.e. use cycle_time not %{cycle_time}). Also, keep in mind that regexp matching is case-sensitive by default.

5

I tried (use cycle_time not %{cycle_time})) this.

This is not working.

Please suggest me is there any other solution.

6

Did you try with a capital "Z" instead of "z"?

7

Yes,I tried with capital Z.
getting gsub mutation is only applicable for Strings.

for the above error i tried

mutate {
add_field => {"testcheck" => "%{cycle_time}"}
convert => { "testcheck" => "string" }
gsub => [ "testcheck", "Z", "" ]
}

This is also not working.First of all date field not converting to string.

I don't required to log stash capture as date field.Is there any way where i can tell log stash don't capture column as date field.If it capture cycle_time as string field my problem will solve.

8

Oh, cycle_time is a date. Then I suggest you use a ruby filter to format the timestamp in any way you like and store in a different field.

I gave the same answer to the exact same question just a few hours ago. Either there are two of you having the same problem at the same time or you posted the same question twice (please don't do that).

9

Thanks for your quick reply...

I am not aware of this.

Can you please give me example to use ruby filter to convert time format.

10

Sorry, I don't have an example.

11

I am still stuck in this issue.

I tried bellow ruby filter but its not working.

filter {
ruby {
code => "event['cycle_time'] = event['cycle_time'].localtime('+02:00')"
}
}

Please help me how can solve....

12

What does "it's not working" mean? Do you get incorrect results? Or nothing happens at all? Any error message in Logstash's log?

13

nothing happening....
even i am not getting any error as well...

14

Please comment out the ruby filter and show us what the event looks like. Use a stdout { codec => rubydebug } output.

15

i am getting bellow error when i add [quote="magnusbaeck, post:14, topic:71775"]
stdout { codec => rubydebug }
[/quote]

[2017-01-20T14:37:02,553][ERROR][logstash.filters.ruby ] Ruby exception occurred: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details.

16

Aha, right. So did you read the documentation the error message points you to?

This piece of Ruby will work better:

event.set('cycle_time', event.get('cycle_time').localtime('+02:00'))
17

Getting below error

[2017-01-20T14:56:02,576][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined method `localtime' for 2017-01-07T03:30:07.000Z:LogStash::Timestamp

doc and my system time zone both are same.

18

Okay. Then my suggestion is this:

event.set('cycle_time', event.get('cycle_time').time.localtime('+02:00'))
19

Thanks for your quick reply...

I am getting bellow error

Ruby exception occurred: undefined method `time' for nil:NilClass

using below filter
ruby {
code => "event.set('cycle_time', event.get('cycle_time').time.localtime('+02:00'))"
}

20

That indicates that you tried to use that ruby filter for an event that didn't have a cycle_time field. One way of mitigating that would be:

event.set('cycle_time', event.get('cycle_time').time.localtime('+02:00')) unless event.get('cycle_time').nil?