Convert @timestamp to string


(Paltryeffort) #1

I'd like to upgrade logstash 1.4 to 1.5. Before my logstash server processes the actual message I copy the @timestamp to a new field in order to know when the server received the message:
mutate {
add_field => [ "receive_time", "%{@timestamp}" ]
}

In 1.5 @timestamp is now a date object which conflicts with the 1.4 (string) in elasticsearch. How do I copy and convert the @timestamp into a string in 1.5?


(Magnus B├Ąck) #2

I can't reproduce this with Logstash 1.5.4:

$ echo hello | /opt/logstash/bin/logstash -e 'input { stdin { } } filter { mutate { add_field => { "receive_time" => "%{@timestamp}" } } } output { stdout { codec => rubydebug } }'
Logstash startup completed
{
         "message" => "hello",
        "@version" => "1",
      "@timestamp" => "2015-10-26T18:51:17.096Z",
            "host" => "hallonet",
    "receive_time" => "2015-10-26T18:51:17.096Z"
}
Logstash shutdown completed

(Paltryeffort) #3

SOLVED:
I was looking at the wrong place.
The problem is that elasticsearch creates a date object instead of a string. To solve this I added this to my elasticsearch output template:

     "receive_time" : {
       "type" : "string"
     }

The only downside is that the format looks a bit different.

In logstash 1.4 it looks like "2015-10-28 15:08:09 +0100"
In logstash 1.5 it looks like "2015-10-28T14:09:49.264Z"

I guess I have to live with that.


(system) #4