Extract day, month and year from a date field. Changing Timezone

Elastic Stack Logstash
1

Hi, I would like to add some fields extracting data from "[layers][frame][frame_frame_time]" field. My code is:

date {
      match => [ "[layers][frame][frame_frame_time]","ISO8601" ]
      target => "[layers][frame][frame_frame_time]"
      
      #2021-02-20T03:32:31.413001000Z


      timezone => "Europe/Madrid"
      add_field => {"mes" => "%{+MM}" }
      add_field => {"dia" => "%{+dd}" }
      add_field => {"ano" => "%{+YYYY}" }
      add_field => {"hora" => "%{+HH}" }
    }

The result is that I get the Month, day, year and hour of the "timestamp" field instead of the one that I want to.

2021-03-18_12-31-36
2021-03-18_12-31-361895×258 34.8 KB

In addition to that, I can not get the hour to match the one in the field, even changing the timezone.

Thanks in advance for your help.

2

logstash and elasticsearch always store timestamps as UTC. sprintf references will always be in UTC. If you want the sprintf references to be in another timezone you will have to lie to logstash about what timezone [@timestamp] is in. (And note that sprintf references use [@timestamp], not whatever field the date filter is using.)

3

Thanks for the answer. Any idea how could I extract that same data from
[layers][frame][frame_frame_time] field?

4

Use a ruby filter and strftime.

5

I tried the solution in the referenced post and worked perfectly. Thank you.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.