How to compare dates without timestamp

Elastic Stack Logstash
1

Hello Team,

I want to compare dates with @timestamp , but I don't want to compare the time , only the date part I want to compare.

I tried using date filter but could not set date in dd/MM/YY format

any pointers to resolve the issue are really appreciated.

Thank you,
Aditya

2

Hi @adityaPsl,

you could try using something like %{+YYYY.MM.dd} which e.g. I use for daily index naming

Add this filter (edit to taste)

filter {
  mutate {
    add_field => { "foo_date" => "%{+YYYY.MM.dd}" }
  }
}

Then you can compare the field foo_date

3

This is the best documentation I can quickly find...

%{+YYYY.MM.dd}

Sets the third part of the name to a date based on the Logstash @timestamp field.

4

Thank you for your response A_B. it helps.

Could you please let me know if There is a way to convert the date which is coming as date time field (dd/MM/yyyy HH:MM:SS) to date field with 'dd/mm/yyyy' format.

Thank you,
Aditya

5

I think %{+dd/MM/YYYY} sould do the trick. Did not test though... As long as the date was initially parsed correctly and is in the @timestamp field.

If the original timestamp is to be extracted from some other field, you can use the date filter.

6

You can discard everything except the date using mutate+gsub, then parse it using a date filter.

mutate { gsub => [ "field", "^([0-9]{2}/[0-9]{2}/[0-9]{4}).*", "\1" ] }
7

Thank you very much A_B and Badger,
really appreciate the help.

i was able to extract the numbers but , could not find the option in date filter to set the format for target field. if i scan the field from date filter it again converts date in datetime format.

one more query
can we convert date from one timestamp to another for example UTC to GMT.

Thank you very much for your help and support.

Thank you,
Aditya

8

All timestamps in elasticsearch are stored in UTC. Kibana will, by default, convert them to your local timezone.

9

Ok..but while comparing dates in logstash , I will need to convert dates to some common timezone. and dates coming from source are on different timezones.
So two requirements

  1. Convert dates to common timezone
  2. Compare only the date part

Thank you for your help and support.

Thank you,
Aditya

10

I you have a pattern in the events that allows you to check whether a particular format should apply then check for that pattern in the event. Otherwise use the same pattern.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.