Converting MMM to MM in Logstash

Elastic Stack Logstash
1

I have typical Apache logs as follows

10.240.135.132 - - [22/Aug/2016:10:46:10 +0000] "GET /v1/cc_services/neutron_controller HTTP/1.1" 200 729 "-" "python-requests/2.9.1"

As the month is in MMM format, I would like to convert it to MonthNumber such as for Aug it should be 08. I know "if else" can do it, but I wanted to know if there is anything simpler way to this?

2

You could use the mutate filter's gsub option, but why do you want to do this in the first place? The normal procedure would be to parse the timestamp with the date filter, and that plugin supports parsing month names.

3

Actually I am trying to create a additional time stamp field, say X, which takes exact time of log and normalize all time stamps in all kinds of logs in format YYYY-MM-dd, HH:mm:ss, make this as "date" kind of field and sort logs based on it. Similar to ISO format. Kibana time is brower time, it can't be used for that purpose.
When I am creating X with Aug and use format 2016-Aug-22, ES throws error saying it is not unable to parse this kind of date format.

4

Actually I am trying to create a additional time stamp field, say X, which takes exact time of log and normalize all time stamps in all kinds of logs in format YYYY-MM-dd, HH:mm:ss, make this as "date" kind of field and sort logs based on it.

That sounds exactly like what the date filter already does.

Kibana time is brower time, it can't be used for that purpose.

That's configurable.