How to convert extract month from date

Elastic Stack Logstash
1

Hi,
I have below date format .
First_date : Feb-21 (MMM-yy)
Second_date: 12/02/2021 (MM/dd/yyyy)

first, I want new field like below:
from first date I need month . so output should be
first_date_month : 02
second date month: 12

Second, I want it to convert as follow:
if first_date_month is in between 01 to 03 then create new field as below
quarter :Q1

I know this is bit confusing. Please help me with this.

Thanks in advance

2

You can extract the month fields using either dissect or grok. You can map an abbreviation of a month into a number using a translate filter. You can also use translate to map months to quarters.

3

I have tried this
if[start_date]
{
date {
match => [ "start_date" , "MMM-yy","yy-MMM"]
target => "startdatetarget"
}
}

grok {match => ["startdatetarget", "%{YEAR:year}-%{MONTH:month}"]
add_field => ["as_of_date", "%{month}"]}

date { match => [ "actual_closed_month" , "MM/dd/yyyy","MM/dd/yy","MM-dd-yy" ]
target => "actualclosedmonthtarget"
}
ruby {
code => "event.set('[start_date_epoch]', (1000event.get('startdatetarget').to_f).round(0))
event.set('[actual_closed_month_epoch]', (1000event.get('actualclosedmonthtarget').to_f).round(0))"
}

	======================================================================
	output I am getting is 
	First scenario--> example 
	"start_date" : "Nov-19",
	"startdatetarget" : "**2019**-10-31T18:30:00.000Z",
	Nov 19 is 2019-10 (Oct)
	as_of_date I am not getting any value for this 
	Second Scenario -->
	"_source" : {
      "actualclosedmonthtarget" : "**0019**-05-01T18:06:32.000Z",
      "actual_closed_month" : "5/2/19",
      "actual_closed_month_epoch" : -61557170008000
    }

actual closed month value is 5/2/19 which is MM/DD/yy but target value is coming as 0019 instead of 2019.

Please help me with this .

Thanks in advance

4

The Java documentation says "For parsing, if the number of pattern letters is more than 2, the year is interpreted literally, regardless of the number of digits. So using the pattern "MM/dd/yyyy", "01/11/12" parses to Jan 11, 12 A.D."

The patterns in a date filter are tried in order. In this case the first one will work, so the second one is never tried. I would suggest (but have not tested) changing the order of entries.

match => [ "actual_closed_month", "MM/dd/yy", "MM-dd-yy", "MM/dd/yyyy" ]
5

Thanks for reply it worked.
But still I am not getting how to extract month.
I tried below code
date { match => [ "actual_closed_month" , "MM/dd/yy","MM-dd-yy","MM/dd/yyyy" ]
target => "actualclosedmonthtarget"}
grok { match => ["actualclosedmonthtarget", "^%{YEAR}-%{MONTH:actual_month}"]}

I am not getting proper response
"actual_epoch" : 1604255400000,
"actualclosedmonthtarget" : "2020-11-01T18:30:00.000Z",
"actual_month" : "1",
"actual_closed_month" : "11/2/20"
November month is coming as 1.

Am I doing something wrong with the code

Thanks in advance

6

I am surprised that matches at all, since MONTH matches the name or abbreviation of a name. You could try MONTHNUM. If that still matches 1 then try `-%{MONTHNUM:actual_month}-"

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.