How to change date format in logstash?

Elastic Stack Logstash
1

My raw data comes in epoch format e.g. 430201865. I can parse this to UNIX using the date filter in logstash like so

date {
  match => ["time", "UNIX"]
  target => "timestamp"
  remove_field => ["time"]
}

This produces the date in a format like so: 1983-08-20T20:50:10.000Z, but I have a format on my Elasticsearch template for my index like so uuuu-MM-dd HH:mm:ss Z. This results in an error when parsing the date, as it does not match the format we are expecting.

Is there a way for me to convert the my date into the format I am expecting?

2

Use a ruby filter and strftime.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.