How can I use the date filter (match) with many fields

Elastic Stack Logstash
1

Hello!

I want to match the date from a cvs file that comes in different fields with logstash! The date in the cvs file come in four fields (four columns) for example:

|Fecha_Trans|HH|MM|SS|
180314 |16 | 40 |45|

I was trying to do this but only is working with the field "Fecha_Trans" in the timestamp but is not recognizing the HH field, MM field and SS. ¿How Can I nest the fields?

date {
match => [ "Fecha_Trans", "yyMMdd" ]
match => ["HH", "HH"]
match => ["MM", "mm"]
match => ["SS", "ss"]
}

2

The date filter parses a single field. If your timestamp is spread over multiple fields you'll have to combine them first. You can e.g. use a mutate filter for that.

3

Hello Magnusbaeck!

Thanks so much for your reply! I'm so sorry I'm new with this tool of logstash, do you have any suggestions of which type of mutate filter can I use?

4
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.