I have many timestamp fields:
AdmitDateTime
DCDateTime
etc.
I want to pull out the yyyy, MM, dd parts individually from them, eg
copy => {
"AdmitDateTime" => "@timestamp"
}
add_field => {
AdmitYear => "%{+yyyy}"
AdmitMonth => "%{+MM}"
}
copy => {
DCDateTime => "@timestamp"
}
add_field => {
DCYear => "%{+yyyy}"
DCMonth => "%{+MM}"
}
etc.
Unfortunately, the %{+<format>} like "%{+yyyy}" will only work on @timestamp field, not on any other fields.
Is there a shorthand, like "%{<field>+<date format>}", e.g. "%{AdmitDateTime+yyyy}" ?
Thanks