Convert utc format to local time

Elastic Stack Logstash
1

hi
I am using logstash to output data from elasticsearch to file. A field named 'snapTime' in elasticsearch is represented by utc format '2018-09-10T15:05:43.000Z' and logstash outputs this field in utc format to file too. Now I want to convert utc format to local time(China), e.g, convert '2018-09-10T15:05:43.000Z' to '2018-09-10 23:05:43' and output it to file. It seems like ruby can make efforts, I try some scripts as follows:

filter{
ruby{
code => "event.set('snapTime',event.get('snapTime').localtime('+08:00'))"
}
}

Then an exception occurs as
'Ruby exception occurred: undefined method `localtime' for "2019-01-10T02:39:12.000Z":String'.
Obviously event.get('snapTime') gives a string not a time. How to implement convertion from utc to local in logstash? thank you

2

I think you need to import Time class in order to use it's methods. Also, as you said, you have to parse the string into a Time-class instance.
Try something like this:

filter {
  ruby {
    init => 'require "time"'
    code => 'event.set("snapTime", Time.parse(event.get("snapTime")).localtime("+08:00"))'
  }
}
3

thank you. I have tried as your said. Athough no exception happens, the 'snapTime' filed still retainutc format rather than my local time zone.
The filter as follows:

filter{
ruby{
init => 'require "time"'
code => "event.set('snapTime',Time.parse(event.get('snapTime')).localtime('+08:00'))"
}
}

The rubydebug stdout as follows:
{
"snapTime" => 2019-01-10T02:39:12.000Z,
"@version" => "1",
"@timestamp" => 2019-01-15T07:22:59.390Z,
"name" => "wangqh"
}
the field 'snapTime' still retain '2019-01-10T02:39:12.000Z' rather than '2019-01-10T10:39:12.000+08:00'

4

Yes of course it stays in ISO8601 format, because no line of that code changes it. If you want it in different format, you need to specify it, for example:

Time.parse(event.get("snapTime")).localtime("+08:00")).strftime("%Y-%m-%d %H:%M:%S")

If this wasn't the case and I misunderstood your first post, I have to get more information.
Could you give an example input line, and then try it with a simple pipeline, only stdin input, this as the only filter, and stdout rubyrebug in output.

5

It works after specify format. thank you

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.