How to change date format in logstash

Elastic Stack Logstash
1

I have a logs like below;

04/12/2020 5:12:56 PM
05/12/2020 6:13:36 AM

I want to match this fields and change to this format in below;

2020-12-04 17:12:56
2020-12-04 06:13:36

How can i do this in logstash ?

Thanks for answering

2

Checkout the Logstash Date Filter Plugin and Joda-Time for more working with Dates.

If you want to experiment more time to fine tune your results, give this try:

input {
  generator  {
    message => '{"my_date": "04/12/2020 5:12:56 PM" }'
    count => 2
  }

  generator  {
    message => '{"my_date": "05/12/2020 6:13:36 AM" }'
    count => 2
  }
 
}
filter {
  json { 
    source => "message" 
  }

  date {
    match => ["my_date", "dd/MM/YYYY hh:mm:ss a" ]
    timezone =>"UTC"
    target => ["@timestamp"]
  }
}
output { 
  stdout { 
    codec => rubydebug 
  } 
}

Results:

{
      "@version" => "1",
       "my_date" => "05/12/2020 6:13:36 AM",
      "sequence" => 0,
    "@timestamp" => 2020-12-05T06:13:36.000Z,
       "message" => "{\"my_date\": \"05/12/2020 6:13:36 AM\" }",
          "host" => "3af2031542b8"
}
{
      "@version" => "1",
       "my_date" => "04/12/2020 5:12:56 PM",
      "sequence" => 1,
    "@timestamp" => 2020-12-04T17:12:56.000Z,
       "message" => "{\"my_date\": \"04/12/2020 5:12:56 PM\" }",
          "host" => "3af2031542b8"
}
{
      "@version" => "1",
       "my_date" => "04/12/2020 5:12:56 PM",
      "sequence" => 0,
    "@timestamp" => 2020-12-04T17:12:56.000Z,
       "message" => "{\"my_date\": \"04/12/2020 5:12:56 PM\" }",
          "host" => "3af2031542b8"
}
{
      "@version" => "1",
       "my_date" => "05/12/2020 6:13:36 AM",
      "sequence" => 1,
    "@timestamp" => 2020-12-05T06:13:36.000Z,
       "message" => "{\"my_date\": \"05/12/2020 6:13:36 AM\" }",
          "host" => "3af2031542b8"
}

Let me know if this helps.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.