I have a column date when i write a config file and parse data into logstash the date column save by default into string format i want to convert date string column into date format can someone help really appreciate it .
I
1 Like
Have you try to create a template in logstash and map this field to date (maybe with format option) ?
I have tried this date format but nothing will change
date {
match => [ "Date", "MMM dd, yyyy HH:mm:ss a" ]
}
but all goes in vain then i try the ruby plugin but still its show on string format not date format can you figure out how to change string into date format
ruby {
code => "
event['Date'] = Date.parse(event['Date']);
"
}
When i say you to use template, it's in the output.
Do you use elasticsearch in output ?
Do you manage index template with Logstash ?
yes i manage index template with logstash and use elasticsearch in the output
Hi @Syed.Ubaid
Try adding a filter in logstash like this:
filter {
mutate {
convert => { "Date" => "date" }
}
}
Try this solution
mutate {
convert => { "Date" => "date" }
}
Logstash failed to parse the data but when i run without it, it parse the data.
My date column includes this value 4/30/2019 23:54 when i parse the data by default in kibana it show datatype string i want to change the string datatype into date datatype
Maybe the problem is the date format in kibana.
Have you change the default date format?
management>advance settings>date format:
I have not make any changes in it the default date is showing as per your screenshot.
Could you share a screenshot showing one value of the date as a string for example like this:
(mine is in date format but I want to see yours in string)
Please check the attached picture 
if you see @timestamp is showing date format where the date column is showing in string datatype
Yes, but could you show me a value like I did before showing one date?
Ok, try changing the date format as I did in this screenshot (with this date format MM.DD.YYYY HH:mm):
Ok then what to do ?? I have change the date format as desired. Could you please tell should i run the config file again ??
i run the config file and then check the result it still shows the date field in the string format no change in the datatype. Attach is the screenshot please check..
I see...
This is weird because ES should change the datatype to Date automatically...
Try adding this line in the Scaled date format section:
["MM/DD/YYYY HH:mm"]
And check if change the datatype to date.