# Editing date time filed in json filter output

**URL:** <https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136>\
**Category:** Logstash\
**Created:** [April 24, 2021, 9:42am UTC](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136 "2021-04-24T09:42:58Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![sahere37](https://avatars.discourse-cdn.com/v4/letter/s/b2d939/32.png) [@sahere37](https://discuss.elastic.co/u/sahere37)\
**Post date:** [April 24, 2021, 9:42am UTC](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136/1 "2021-04-24T09:42:58Z")

</div>

Hi all  
I am using filebeat 7.8 which sends log to logstash 7.8. Each line of log is as following:

`{"req": { "service": ser1,"re_date": "2020-09-10T09:14:38.479"}}`  
and my logstash filter is as following:

```
         input {
           beats {
           port => 5044
         }
         }
        filter {
            json {
            source => "message"
          }
        }
    	output {

      elasticsearch {
        hosts => ["0.0.0.0:9200"]
            index => "test"
            }
           stdout { codec => rubydebug }
          }

```

which will be index in elasticsearch as following event:

```
req.service: ser1
req.re_date: 2020-09-10T09:14:38.479

```

Now, i want to change req.re\_date format to (2020/09/10T09:14:38.479) using following filter, but the output is still same and dose not make any change.

```
input {
  beats {
    port => 5044
  }
}
filter {
      json {
        source => "message"
      }
	  		mutate {
	gsub => [
		"%{req.re_date}", "-", "/"
		]
}
	
    }
	output {

  elasticsearch {
    hosts => ["0.0.0.0:9200"]
        index => "test"
        }

stdout { codec => rubydebug }
  }

```

Any advise will be so appreciated.

Regards

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [April 24, 2021, 12:56pm UTC](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136/2 "2021-04-24T12:56:10Z")

</div>

Try `gsub => ["[req][re_date]", "-", "/" ]`

---

<div class="post-metadata">

**Author:** ![sahere37](https://avatars.discourse-cdn.com/v4/letter/s/b2d939/32.png) [@sahere37](https://discuss.elastic.co/u/sahere37)\
**Post date:** [April 24, 2021, 1:09pm UTC](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136/3 "2021-04-24T13:09:11Z")

</div>

Many thanks for your reply. But, output is still the same as "2020-09-10T09:14:38.479". Following warning has been found in the log:

`[2021-04-24T17:34:28,262][WARN][logstash.filters.mutate][main][e1ebc65d12b5ed0ee94689d88d19899b9e56d1373846c87a546ce6517ca7e2f6] Exception caught while applying mutate filter {:exception=>"Invalid FieldReference: `{[req][re\_date]}`"}`

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [April 24, 2021, 1:24pm UTC](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136/4 "2021-04-24T13:24:35Z")

</div>

Are you using `{[req][re_date]}` or `[req][re_date]`? Should be the second one.

Here is a full example that works.

```auto
input {
   generator {
     lines => ['{"req": { "service": "ser1","re_date": "2020-09-10T09:14:38.479"}}']
     count => 1
     codec => json
   } 
}
filter {
    json { source => "message"}
    mutate { gsub => ["[req][re_date]", "-", "/" ] }
}
output { stdout { codec => json_lines } }

```

---

<div class="post-metadata">

**Author:** ![sahere37](https://avatars.discourse-cdn.com/v4/letter/s/b2d939/32.png) [@sahere37](https://discuss.elastic.co/u/sahere37)\
**Post date:** [April 24, 2021, 1:42pm UTC](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136/5 "2021-04-24T13:42:53Z")

</div>

I am using [req][re\_date]. it seems mutate filter dose not recognize req.re\_date as a field which is a key of json filter output. I used a simple in put as following:

` {"request": "2020-09-10"}`

and following logstash config:

```
input {
  beats {
    port => 5044
  }
}
filter {
      json {
        source => "message"
      }
	  		mutate {
	gsub => [
		"{[request]}", "-", "/"
		]
}

    }
	output {

  elasticsearch {
    hosts => ["0.0.0.0:9200"]
        index => "test"
        }

stdout { codec => rubydebug }
  }

```

and still, logsatsh out put is as following:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a9c839a0cebca501c2280935055127630d72d5a8.png)

---

<div class="post-metadata">

**Author:** ![sahere37](https://avatars.discourse-cdn.com/v4/letter/s/b2d939/32.png) [@sahere37](https://discuss.elastic.co/u/sahere37)\
**Post date:** [April 24, 2021, 2:13pm UTC](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136/6 "2021-04-24T14:13:08Z")

</div>

also. I used following config and still output is not expected:

```
input {
  beats {
    port => 5044
  }
}
filter {
      json {
        source => "message"
      }
	  		mutate {
	gsub => [
		"{%{request}}", "-", "/"
		]
}
    }
	output {
  elasticsearch {
    hosts => ["0.0.0.0:9200"]
        index => "test"
        }
stdout { codec => rubydebug }
  }
```

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [April 24, 2021, 2:33pm UTC](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136/7 "2021-04-24T14:33:35Z")

</div>

You keep putting `{ }` around the field name and that is what is messing it up.

Just use exactly like how I am and it works.

`mutate { gsub => ["[req][re_date]", "-", "/" ] }`

---

<div class="post-metadata">

**Author:** ![sahere37](https://avatars.discourse-cdn.com/v4/letter/s/b2d939/32.png) [@sahere37](https://discuss.elastic.co/u/sahere37)\
**Post date:** [April 28, 2021, 10:52am UTC](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136/8 "2021-04-28T10:52:27Z")

</div>

Many thanks. It works

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 26, 2021, 10:52am UTC](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136/9 "2021-05-26T10:52:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.