Get seconds from the timestamp and put the into separate field

Elastic Stack Logstash
#1

Hello, I am trying to do the following:

If the field mymessage contains My string, create another field called seconds and put there the bolded value of my timestamp - November 15th 2015, 08:42:29.779. In other words I would like this to result in seconds=29.779 which is taken from the timestamp of the event, but unfortunately this puts value of %{SECOND}

Pasted image781×95 3.05 KB

if [mymessage] =~ /^My string/ {
mutate {
add_field => [ "seconds", "%{SECOND}" ]
}
.....
}

What am I doing wrong?

#2

I think you might be conflating grok patterns and fields. You get "%{SECOND}" because the messages doesn't have a field named SECOND.

Use a grok filter to extract the seconds from the @timestamp field. Untested:

grok {
  match => ["@timestamp", ":%{SECOND:seconds}Z"]
}
#3

how can i extract hours , minute and also weekday from timestamp..

#4

You just have to find the pattern you want to use in grok, see here for available patterns :

https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns

#5

thank you so much for such a soon reply...
i did manage to get the the hours , minute , sec from the timestamp..

But is there any possibility of geeting week day from the timestamp..

for example this is my timestamp "11/May/2016:05:00:00 +0530"
how can i achieve the weekday from this ..
like
weekday:wednesday

thank you

#6

I don't think there's a plugin that'll do this for you, but you can definitely write some Ruby code and put in a ruby filter.

1 Like
#8