How can I convert @timestamp from logstash to encoded format as YYYY-MM-DDThh:mm:ss.sss+/-hh:mm

Elastic Stack Logstash
1

I have tried using date filter match option but didn't work.
It would be great if someone can help me here.

2

And what is your filter syntax?

3 
    date {
            match => [ "timestamp", "ISO8601" ]
            target => "@timestamp"
      }

Here "timestamp" is the variable where I want to store the converted timestamp

4

Yes, this is how should code be in general.
And how does your data look like? Can you give an example?

5

Here I am sending input message to logstash from filebeat and checking the message in Elasticsearch. There are few things I am trying to achieve here, like when we don't send any timestamp in input message then I will be taking "@timestamp" (timestamp at which logstash recieves the event)value and will convert to the format I want and save it in different field "timestamp".
@timestamp we get from Logstash generally in this format "2022-10-27T03:49:25.530Z"
I want new timestamp field with this format [YYYY-MM-DDThh:mm:ss.sss+/-hh:mm]

6

I don't think this is possible, using the date filter will transform the field into a date type field which will have this format yyyy-MM-ddTHH:mm:ss.SSSZ and the time will always be in UTC (that's waht the Z at the end means)

7

ok. Can you suggest me any other filter in Logstash or any logic with which I could achieve this conversion

8

It depends, if you want the field to be a date field, then there is none, all date fields will have this format.

What you may try is to use some ruby code with the ruby filter to create a string with the format you want, but this will need to be mapped as a string in elasticsearch.

9

yeah in that case may be I can use date filter to convert that string after conversion to date again. Is that possible?

10

I have also found one similar issue attaching code solution and link below.

ruby {
        code => '
            t = Time.at(event.get("@timestamp").to_f)
            event.set("someField", t.strftime("%Y-%m-%d"))
        '
    }

But not sure how can I use this code to get the format I want [YYYY-MM-DDThh:mm:ss.sss+/-hh:mm]

11

You want to add time offset to UTC? You can add as abs. like timezone => "+0100" or relatively to a time zone.

	date {
      match => [ "timestamp", "ISO8601" ]
      timezone => "Europe/Berlin"
	  target=> "@timestamp"
	}
12

Here I don't want to change timezone I want offset as +00:00. Can I use the way you mentioned even for that case?

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.