How to convert field date from String to Date?

Elastic Stack Logstash
1

I want to convert the field of date from string to date, i try this code in my config file but it doesn't change in kibana..I don't know why! any help??

filter{
csv{
columns => ["car","date","dateEntree","dateSortie"]
separator => ","
}
date {
match => ["date", "dd/MM/YY"]
target => "date"
}
}

in the console when i run the config file he turn this

{
"date" => "05-03-2020",
"@timestamp" => 2020-03-20T17:26:43.463Z,
"voiture" => "V8",
"dateSortie" => "07",
"tags" => [
[0] "_dateparsefailure"
],
"dateEntree" => "04"
}

1 Like
2

That does not match "dd/MM/YY". Try "dd-MM-YY".

1 Like
3

in my csv file i have column like this ;
Date
05.03.2020
05.03.2020
06.03.2020
.....
So i change in my file config like this : {
match => ["Date", "dd.MM.yyyy"]
target => "Date"
}

=====> i don't understand why he return in logstah this format ??
"Date" => 2020-03-04T23:00:00.000Z,
"Status" => "OK",
"@timestamp" => 2020-03-22T16:51:00.292Z,

4

That's the format of a LogStash::Timestamp. It means the date filter has successfully parsed the field.

1 Like
5

OK!! but it does not display the data in the date column in my csv file, i try this format "dd-MM-YY"
he return the same thing? what shoud i do??

6

If the field in elasticsearch is currently text, then if logstash sends a date elasticsearch will convert it to text as it indexes a document. If the field does not currently exist then elasticsearch will index it as a date. Try rolling over to a new index.

7

even if i create a new index it return the same thing ..!!

8

Is it possible you have an index template in elasticsearch that forces the field to be text?

9

when i test in console of kibana GET /myIndex/_mapping

"myIndex" : {
"mappings" : {
"properties" : {
"@timestamp" : {
"type" : "date"
},
"Date" : {
"type" : "date"
},
"Status" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
....................
so here it's change but i don't know where is the data of date in my csv file?

10

OK, in the Discover pane in Kibana, if you expand an event and click on the JSON tab what does the Date field look like?

11

"date": "2020-03-23T23:00:00.000Z",

13

OK, so in elasticsearch it is a date. I don't understand what problem you have. Are you saying you want to modify the source CSV file?

14

thank you very much for your answer
my problem is solved, thank you.
just I have another question about the input file in logstash in real time, can I ask my question please,maybe you can advice me!!

15

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.