Convert YYYY-MM-DD-HH.MM.SS to date

I have a dateTime field with the following format:

I want to use this field as a date time field in ELK. I don't know how to change 11th position of the string('-') to 'T' to convert this field into yyyy-mm-ddThh-mm-ss format.

I'm new to logstash, I didn't find anything for string manipulation or position based replace.

You just need to pass your pattern to the date filter.

Try this:

date {
  match => [ "dateTime", "" ]

Using a date filter is probably the best solution, but to answer your question you can use

mutate { gsub => [ "dateTimeField", "^.{10}-", "\1T" ] }

to change the 11th character from - to T

Thank you @leandrojmp. It works.

@Badger I really need this regex syntax for string manipulation. Thank you.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.