# Date型を文字列型に変換する方法について

**URL:** <https://discuss.elastic.co/t/date/287866>\
**Category:** 日本語による質問・議論はこちら\
**Created:** [October 28, 2021, 2:35am UTC](https://discuss.elastic.co/t/date/287866 "2021-10-28T02:35:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![t-nakata](https://avatars.discourse-cdn.com/v4/letter/t/8491ac/32.png) [@t-nakata](https://discuss.elastic.co/u/t-nakata)\
**Post date:** [October 28, 2021, 2:35am UTC](https://discuss.elastic.co/t/date/287866/1 "2021-10-28T02:35:12Z")

</div>

とあるdate型のフィールドについて、date型のフィールドは保持しつつ、同じ値を文字列型のフィールドにも保持したいです。

■logstashのconfファイル

```auto
input {
 ～省略～
}

filter {
 json {
  source => "message"
 }
 date {
  match => ["timestamp", "UNIX_MS"]
  target => "timestamp_cloudwatch"
  remove_field => ["timestamp"]
 }
 json {
  source => "message"
 }
 date {
  match => ["timestamp", "UNIX_MS"]
  target => "timestamp_log"
  remove_field => ["timestamp"]
 }
    ruby {
           code => "
               event.set('timestamp_cloudwatch_s',event.get('timestamp_cloudwatch').time.localtime.strftime('%Y-%m-%dT%T.%L'));
               event.set('timestamp_log_s',event.get('timestamp_log').time.localtime.strftime('%Y-%m-%dT%T.%L'));
           "
    }
      mutate {
        convert => {
          "timestamp_cloudwatch_s" => "string"
          "timestamp_log_s" => "string"
        }
      }
}

output {
 ～省略～
}

```

■inputデータ

```auto
{"timestamp":1623986333029,"message":"{\"timestamp\": 1623986333029,\"formatVersion\": 1,\"webaclId\": \"arn:aws:wafv2:ap-southeast-2:EXAMPLE12345:regional/webacl/STMTest/1EXAMPLE-2ARN-3ARN-4ARN-123456EXAMPLE\",\"terminatingRuleId\": \"STMTest_SQLi_XSS\",\"terminatingRuleType\": \"REGULAR\",\"action\": \"BLOCK\",\"terminatingRuleMatchDetails\": [{\"conditionType\": \"SQL_INJECTION\",\"location\": \"HEADER\",\"matchedData\": [\"10\",\"AND\",\"1\"]}],\"httpSourceName\": \"-\",\"httpSourceId\": \"-\",\"ruleGroupList\": [],\"rateBasedRuleList\": [],\"nonTerminatingMatchingRules\": [],\"httpRequest\": {\"clientIp\": \"1.1.1.1\",\"country\": \"AU\",\"headers\": [{\"name\": \"Host\",\"value\": \"localhost:1989\"},{\"name\": \"User-Agent\",\"value\": \"curl/7.61.1\"},{\"name\": \"Accept\",\"value\": \"*/*\"},{\"name\": \"x-stm-test\",\"value\": \"10 AND 1=1\"}],\"uri\": \"/foo\",\"args\": \"\",\"httpVersion\": \"HTTP/1.1\",\"httpMethod\": \"GET\",\"requestId\": \"rid\"},\"labels\": [{\"name\": \"value\"}]}"}

```

■インデックステンプレート

```auto
PUT _index_template/index-s3-aws-waf-template
{
  "index_patterns" : [
    "index-s3-aws-waf*"
  ],
  "template" : {
    "settings" : {
      "number_of_shards" : 1,
      "number_of_replicas" : 1
    },
    "mappings" : {
      "properties" : {
        "timestamp_cloudwatch" : {
          "type" : "date"
        },
        "timestamp_log" : {
          "type" : "date"
        },
        "action" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword"
            }
          }
        },
        "sourceip" : {
          "type" : "ip"
        },
        "statusnonTerminatingMatchingRules.ruleId" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword"
            }
          }
        },
        "uri" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword"
            }
          }
        },
        "terminatingRuleId" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword"
            }
          }
        }
      }
    }
  }
}

```

■登録結果

```auto
{
  "_index": "index-s3-aws-waf-2021.10.21",
  "_type": "_doc",
  "_id": "OuR5oXwBrAiMnUbAmCP_",
  "_version": 1,
  "_score": null,
  "_source": {
    "terminatingRuleId": "STMTest_SQLi_XSS",
    "httpSourceId": "-",
    "@version": "1",
    "timestamp_cloudwatch_s": "2021-06-18T12:18:53.029",
    "action": "BLOCK",
    "httpRequest": {
      "args": "",
      "country": "AU",
      "headers": [
        {
          "name": "Host",
          "value": "localhost:1989"
        },
        {
          "name": "User-Agent",
          "value": "curl/7.61.1"
        },
        {
          "name": "Accept",
          "value": "*/*"
        },
        {
          "name": "x-stm-test",
          "value": "10 AND 1=1"
        }
      ],
      "httpVersion": "HTTP/1.1",
      "requestId": "rid",
      "clientIp": "1.1.1.1",
      "httpMethod": "GET",
      "uri": "/foo"
    },
    "terminatingRuleMatchDetails": [
      {
        "matchedData": [
          "10",
          "AND",
          "1"
        ],
        "conditionType": "SQL_INJECTION",
        "location": "HEADER"
      }
    ],
    "formatVersion": 1,
    "timestamp_log_s": "2021-06-18T12:18:53.029",
    "terminatingRuleType": "REGULAR",
    "ruleGroupList": [],
    "message": "{\"timestamp\": 1623986333029,\"formatVersion\": 1,\"webaclId\": \"arn:aws:wafv2:ap-southeast-2:EXAMPLE12345:regional/webacl/STMTest/1EXAMPLE-2ARN-3ARN-4ARN-123456EXAMPLE\",\"terminatingRuleId\": \"STMTest_SQLi_XSS\",\"terminatingRuleType\": \"REGULAR\",\"action\": \"BLOCK\",\"terminatingRuleMatchDetails\": [{\"conditionType\": \"SQL_INJECTION\",\"location\": \"HEADER\",\"matchedData\": [\"10\",\"AND\",\"1\"]}],\"httpSourceName\": \"-\",\"httpSourceId\": \"-\",\"ruleGroupList\": [],\"rateBasedRuleList\": [],\"nonTerminatingMatchingRules\": [],\"httpRequest\": {\"clientIp\": \"1.1.1.1\",\"country\": \"AU\",\"headers\": [{\"name\": \"Host\",\"value\": \"localhost:1989\"},{\"name\": \"User-Agent\",\"value\": \"curl/7.61.1\"},{\"name\": \"Accept\",\"value\": \"*/*\"},{\"name\": \"x-stm-test\",\"value\": \"10 AND 1=1\"}],\"uri\": \"/foo\",\"args\": \"\",\"httpVersion\": \"HTTP/1.1\",\"httpMethod\": \"GET\",\"requestId\": \"rid\"},\"labels\": [{\"name\": \"value\"}]}",
    "labels": [
      {
        "name": "value"
      }
    ],
    "webaclId": "arn:aws:wafv2:ap-southeast-2:EXAMPLE12345:regional/webacl/STMTest/1EXAMPLE-2ARN-3ARN-4ARN-123456EXAMPLE",
    "@timestamp": "2021-10-21T06:11:13.186198Z",
    "timestamp_log": "2021-06-18T03:18:53.029Z",
    "timestamp_cloudwatch": "2021-06-18T03:18:53.029Z",
    "rateBasedRuleList": [],
    "httpSourceName": "-",
    "nonTerminatingMatchingRules": []
  },
  "fields": {
    "@timestamp": [
      "2021-10-21T06:11:13.186Z"
    ],
    "timestamp_log": [
      "2021-06-18T03:18:53.029Z"
    ],
    "timestamp_cloudwatch": [
      "2021-06-18T03:18:53.029Z"
    ],
    "timestamp_cloudwatch_s": [
      "2021-06-18T12:18:53.029Z"
    ],
    "timestamp_log_s": [
      "2021-06-18T12:18:53.029Z"
    ]
  },
  "sort": [
    1623986333029
  ]
}

```

期待値としては、timestamp\_log、およびtimestamp\_cloudwatchはdate型、それぞれをJSTに変換した値を文字列型でtimestamp\_cloudwatch\_s、timestamp\_log\_sに登録したいです。  
しかし、結果としてはJSTに変換されるのは期待通りなのですが、\_sのフィールドにもdate型で格納されてしまいます。  
実現方法についてご教示頂けないでしょうか。

以下のURLを参考にしています。mutateのconvertを使用すれば出実現できると思ったのですが、期待通りになりませんでした。  
[Mutate filter plugin | Logstash Reference [7.15] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-convert)Processing: index\_template.txt...

---

<div class="post-metadata">

**Author:** ![tsgkdt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsgkdt/32/39151_2.png) [@tsgkdt](https://discuss.elastic.co/u/tsgkdt)\
**Post date:** [October 28, 2021, 2:20pm UTC](https://discuss.elastic.co/t/date/287866/2 "2021-10-28T14:20:17Z")

</div>

Index Template、Mappingの設定のところに、timestamp\_cloudwatch\_s、timestamp\_log\_sの定義がないように見受けられます。

日付型の書式の文字列は、マッピングの定義がなければ、ドキュメント登録時にdate型のフィールドとして登録されたように思います。

ですので、簡易に試すのであれば、timestamp\_cloudwatch\_s, timestamp\_log\_sをkeyword か textのフィールドだと明示的にmapping設定を書けば良いのでは、と思いました。

もう少し汎用的にやるのであれば、dynamic-templatesを使う方法もありそうです。

> **[Dynamic templates | Elasticsearch Guide \[7.15\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-templates.html)**

---

<div class="post-metadata">

**Author:** ![t-nakata](https://avatars.discourse-cdn.com/v4/letter/t/8491ac/32.png) [@t-nakata](https://discuss.elastic.co/u/t-nakata)\
**Post date:** [October 29, 2021, 1:26am UTC](https://discuss.elastic.co/t/date/287866/3 "2021-10-29T01:26:46Z")

</div>

ご回答ありがとうございます。ご教示頂いた方法で上手くいきました。以前同様のことを試した時にエラーになってしまったので、対処法として間違っているのかと思ったのですが、その時は別の原因だったようです

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2021, 1:27am UTC](https://discuss.elastic.co/t/date/287866/4 "2021-11-26T01:27:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.