I have the following date stamp info at the start of my log line and I need to convert them to integers.
Log Line:
2019-06-17 14:05:00.202
Expected Output:
Year: 2019
Month: 06
Date: 17
Hours: 14
Minutes: 05
Sec: 00
Millisec: 202
All the above fields should be in integer for my visualization purposes.
Is there any easy way to do it?
Any help providing me with an example syntax is appreciated
It has been converted to date time format but when I open the parsed logs in kibana I am getting the following errors.
Also the date hour min info are all wrong. only the captured field I named "loggedTime" seems right.
This is the filter I used:
date
{
match => [ "endTime", ISO8601 , "YYYY-MM-dd HH:mm:ss.ZZZ" ]
target => "loggedTime"
}
ruby {
code => '
epochMS = event.get("loggedTime").to_f * 1000
dateTime = DateTime.strptime(epochMS.to_s, "%Q")
event.set("Year", dateTime.year)
event.set("Month", dateTime.month)
event.set("Date", dateTime.day)
event.set("Hours", dateTime.hour)
event.set("Minutes", dateTime.minute)
event.set("Sec", dateTime.second)
event.set("Millisec", epochMS.to_i % 1000)
'
}
When I opened Kibana - the index I created I got th following error.
"
Discover: failed to parse date field [-61566890962977] with format [epoch_millis]: [failed to parse date field [-61566890962977] with format [epoch_millis]]
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.