Changing time zone format


#1

i am using jdbc as input and http as output.

from jdbc i am getting date as "2017-01-02T12:35:44.000Z"
but in my http output date will be accept as "2017-01-02T12:35:44.000+07:00"

when i am checking inn database there not mentioned any timezone.But in output i am getting z

Ho w can i convert from "2017-01-02T12:35:44.000Z" to "2017-01-02T12:35:44.000+07:00" format.

Thanks in Advance......


(Mark Walkom) #2

Logstash uses the system timezone, so what is that set to on the host LS runs on?


#3

Thanks Mark for your quick reply...

but in my http output accept only "2017-01-02T12:35:44.000+07:00" this format.

To remove z in my time format i am using below filter.

mutate {
gsub => [
"%{cycle_time}", "z", ""
]
}

But it's not working for me.My goal is to remove z.
you have working example of gsub or grok or with any other filter.

Please help me how can avoid z in my Time.

Thanks in Advance.....


(Magnus Bäck) #4

The first element of the array you feed to gsub should contain the name of the field, not its contents (i.e. use cycle_time not %{cycle_time}). Also, keep in mind that regexp matching is case-sensitive by default.


#5

I tried (use cycle_time not %{cycle_time})) this.

This is not working.

Please suggest me is there any other solution.


(Magnus Bäck) #6

Did you try with a capital "Z" instead of "z"?


#7

Yes,I tried with capital Z.
getting gsub mutation is only applicable for Strings.

for the above error i tried

mutate {
add_field => {"testcheck" => "%{cycle_time}"}
convert => { "testcheck" => "string" }
gsub => [ "testcheck", "Z", "" ]
}

This is also not working.First of all date field not converting to string.

I don't required to log stash capture as date field.Is there any way where i can tell log stash don't capture column as date field.If it capture cycle_time as string field my problem will solve.


(Magnus Bäck) #8

Oh, cycle_time is a date. Then I suggest you use a ruby filter to format the timestamp in any way you like and store in a different field.

I gave the same answer to the exact same question just a few hours ago. Either there are two of you having the same problem at the same time or you posted the same question twice (please don't do that).


#9

Thanks for your quick reply...

I am not aware of this.

Can you please give me example to use ruby filter to convert time format.


(Magnus Bäck) #10

Sorry, I don't have an example.


#11

I am still stuck in this issue.

I tried bellow ruby filter but its not working.

filter {
ruby {
code => "event['cycle_time'] = event['cycle_time'].localtime('+02:00')"
}
}

Please help me how can solve....


(Magnus Bäck) #12

What does "it's not working" mean? Do you get incorrect results? Or nothing happens at all? Any error message in Logstash's log?


#13

nothing happening....
even i am not getting any error as well...


(Magnus Bäck) #14

Please comment out the ruby filter and show us what the event looks like. Use a stdout { codec => rubydebug } output.


#15

i am getting bellow error when i add [quote="magnusbaeck, post:14, topic:71775"]
stdout { codec => rubydebug }
[/quote]

[2017-01-20T14:37:02,553][ERROR][logstash.filters.ruby ] Ruby exception occurred: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details.


(Magnus Bäck) #16

Aha, right. So did you read the documentation the error message points you to?

This piece of Ruby will work better:

event.set('cycle_time', event.get('cycle_time').localtime('+02:00'))

#17

Getting below error

[2017-01-20T14:56:02,576][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined method `localtime' for 2017-01-07T03:30:07.000Z:LogStash::Timestamp

doc and my system time zone both are same.


(Magnus Bäck) #18

Okay. Then my suggestion is this:

event.set('cycle_time', event.get('cycle_time').time.localtime('+02:00'))

#19

Thanks for your quick reply...

I am getting bellow error

Ruby exception occurred: undefined method `time' for nil:NilClass

using below filter
ruby {
code => "event.set('cycle_time', event.get('cycle_time').time.localtime('+02:00'))"
}


(Magnus Bäck) #20

That indicates that you tried to use that ruby filter for an event that didn't have a cycle_time field. One way of mitigating that would be:

event.set('cycle_time', event.get('cycle_time').time.localtime('+02:00')) unless event.get('cycle_time').nil?