Grok Match but not include

Elastic Stack Logstash
1

Hello, I am trying to parse a custom date&time field like:
date=2022-04-22 time=09:38:04,
currently I have filter like:
(?<timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} time=%{TIME})
and result of timestamp is:
2022-04-22 time=09:38:04 .
I need to remove 'time=' from result, how I can achieve it?

2

You could use

mutate { gsub => [ "timestamp", "time=", "" ] }
3

thank you, it did the job

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.