Convert value of nested date field to UTC with date filter


I am trying to convert values of all date fields to UTC. I use date filter, which works fine for top level fields. However, looks like it does not work for nested fields like

"abc" : [
"dateField" : "2020-09-11T00:00:00-08:00",
I tried date filter like
date {
match => [ "[abc][dateField]" , "ISO8601" , "yyyy-MM-dd'T'HH:mm:ss.SSS a Z" ]
target => "[abc][dateField]"
locale => "en"
#timezone => "America/Los_Angeles"

but there is no change.

Any ideas what is wrong here?
Thx in advance.

this is not nested but array. if there's only one entry, you should be able to access it with [abc][0][dateField]

if it's arbitrary length, you will need ruby filter to iterate over it.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.