Converting century date format to yyyymmdd format

[shruti51 (shruti)]

Hi,

I am trying to convert century format CYYMMDD to YYYYMMDD format in logstash.
Please provide some inputs of how to do it.

[Badger]

I do not understand the distinction between CYY, which would have the first two digits of the year followed by the last two digits of the year, and YYYY, which would look exactly the same.

[shruti51 (shruti)]

Hi Badger,
Thanks For the response.

Regarding the query,CYY will be 119 whereas YYYY will be 2019.

I have to compare my dates. For that My one format is century format. So i am trying to convert my century format to YYYYmmdd format.

[Badger]

You could use something like

if [someField] =~ /1[0-9]{6}/ {
    mutate { gsub => [ "someField", "^1", "20" ] }
}

[shruti51 (shruti)]

Hi badger,

I tried this function but it didnt work. Please find the configuration:

input {
  beats {
    port => 5044
	}
}

  if [fields][log_type] == "SAS" {
		xml {
				source => "message"
				store_xml => false
				xpath => ["/ABC/@NU", "ABD"]
				xpath => ["/pATH/Date/text()", "StartDate"]
}

mutate { 
				add_field => [ "CenturyDate", "%{StartDate}" ]
		}
if [fields][CENTURYDATE] =~ /1[0-9]{6}/ 
		{
		   mutate { gsub => [ "CENTURYDATE", "^1", "20" ] }
}

For input start date: 1190324,
Ouput: Centurydate is 1190324.

I want my output as 21190324.

Please help.

[Badger]

@shruti51

mutate { add_field => [ "CenturyDate", "%{StartDate}" ] }
if [fields][CENTURYDATE] =~ /1[0-9]{6}/

If you add the date to a field called CenturyDate then you need to test for that field, not for some other field. Change the conditional to be

if [CenturyDate] =~ ...

and likewise the mutate+gsub