Date format changes automatically after adding 3600 to dateOptionalTime field

[manishash (minnie)]

I am using 2.3 version.
I know very old but i do got to fix the data.
In a timestamp field which is referenced by got timestamp as of UTC
I have to add 1 hour to the dateOptionalTime field in 1 index.

logstash conf has got this
code => "event['[@fields][DateField]'] = LogStash::Timestamp.new(event['[@fields][DateField]']) + 3600"

it changes date from "2019-04-12T00:00:00-04:00" to "2019-04-12 01:00:00 -0400"

I see that it did add an hour but gives me error while putting into elastic since format has gone bad.

"error"=>;"MapperParsingException[failed to parse [@fields.DateField]]; nested: MapperParsingException[failed to parse date field [2019-04-12 01:00:00 -0400], tried both date format [dateOptionalTime], and timestamp number with locale ]; nested: IllegalArgumentException[Invalid format: "2019-04-12 01:00:00 -0400" is malformed at " 01:00:00 -0400"]; "}

[Badger]

I do not know if it works in 2.3, but in 6.7 I would do

 mutate { gsub => [ "[@fields][DateField]", "^([^ ]+) ([^ ]+) ([^ ]+)$", "\1T\2\3" ] }

That is -- it divides the field into three space separated strings, then recombines them with different separators.

[manishash (minnie)]

@Badger

 mutate { gsub => [ "[@fields][DateField]", "^([^ ]+) ([^ ]+) ([^ ]+)$", "\1T\2\3" ] }

thanks, but this did not work, the expression itself wasnt able to catch spaces.

[manishash (minnie)]

Could there be any other way to add 1 hour to this timestamp field