Date format changes automatically after adding 3600 to dateOptionalTime field

I am using 2.3 version.
I know very old but i do got to fix the data.
In a timestamp field which is referenced by got timestamp as of UTC
I have to add 1 hour to the dateOptionalTime field in 1 index.

logstash conf has got this
code => "event['[@fields][DateField]'] =['[@fields][DateField]']) + 3600"

it changes date from "2019-04-12T00:00:00-04:00" to "2019-04-12 01:00:00 -0400"

I see that it did add an hour but gives me error while putting into elastic since format has gone bad.

"error"=>;"MapperParsingException[failed to parse [@fields.DateField]]; nested: MapperParsingException[failed to parse date field [2019-04-12 01:00:00 -0400], tried both date format [dateOptionalTime], and timestamp number with locale ]; nested: IllegalArgumentException[Invalid format: "2019-04-12 01:00:00 -0400" is malformed at " 01:00:00 -0400"]; "}

I do not know if it works in 2.3, but in 6.7 I would do

 mutate { gsub => [ "[@fields][DateField]", "^([^ ]+) ([^ ]+) ([^ ]+)$", "\1T\2\3" ] }

That is -- it divides the field into three space separated strings, then recombines them with different separators.

thanks, but this did not work, the expression itself wasnt able to catch spaces.

Could there be any other way to add 1 hour to this timestamp field

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.