Convert YYYY-MM-DD-HH.MM.SS to date

Elastic Stack Logstash
1

Hi
I have a dateTime field with the following format:

yyyy-mm-dd-HH.mm.ss

I want to use this field as a date time field in ELK. I don't know how to change 11th position of the string('-') to 'T' to convert this field into yyyy-mm-ddThh-mm-ss format.

I'm new to logstash, I didn't find anything for string manipulation or position based replace.

2

You just need to pass your pattern to the date filter.

Try this:

date {
  match => [ "dateTime", "yyyy-MM-dd-HH.mm.ss" ]
}
3

Using a date filter is probably the best solution, but to answer your question you can use

mutate { gsub => [ "dateTimeField", "^.{10}-", "\1T" ] }

to change the 11th character from - to T

4

Thank you @leandrojmp. It works.

5

@Badger I really need this regex syntax for string manipulation. Thank you.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.