Dateadd feature in logstash

Elastic Stack Logstash
1

Hi,

We have some log files which is dynamic in pattern. We would like to filter the logdate field as, whenver the value is null, then that value should be equal to current timestamp less 6hrs.

In sql, its the same as

ISNULL(logdate,dateadd(hour,logdate,6))

I would like to know how can i accomplish this.
TIA

2

Nver mind. The workaround we did is to use ruby filter. See below.

	ruby {
			init => "require 'time'"
		code => "event.set('logdate', Time.now() - 6*60*60);"
	}