How to convert nummeric values 201901020 into date 02.01.2019

Elastic Stack Logstash
1

Hi all,

I need your help with this case:
How can I convert fields containing values like 201901020 into date 02.01.2019
(the last zero of the value is useless but there)

I tried different mappings using follwoing simple but no success so far:

	date {
	match => [ "FIELD_b", "WHATKINDOFMAPPING ?" ]
	target => "FIELD_c"
	}

Thanks for your help
Brgds

2

I haven't tested it, but "yyyyMMdd'0'" might work (not sure which way around month and day are where you live, so you might need to reverse them).

3

Hi,
thanks for your reply.

No its not working!
I tried also to escape the ' and or in combination with ISO8601, UNIX, UNIX_MS
Only if I use UNIX then I it'll mapped to a date field but with wrong Date!

Any suggestions?

4

Here, you can try.

	mutate {
        #omit the last character
		gsub => [ "message", ".{1}$", "" ]
	}

	date {
		match => [ "message", "yyyyMMdd"]
		target => "FIELD_c"
	}

you might specify the timezone if required.

1 Like
5

OK, so how exactly does it not work. When I run

input { generator { count => 1 lines => [ '' ] } }
filter {
    mutate { add_field => { "FIELD_b" => "201901020" } }
    date { match => [ "FIELD_b", "yyyyMMdd'0'" ] target => "FIELD_c" }
}
output { stdout { codec => rubydebug { metadata => false } } }

I get

    "@timestamp" => 2020-01-30T17:45:53.334Z,
  "sequence" => 0,
   "FIELD_b" => "201901020",
   "FIELD_c" => 2019-01-02T05:00:00.000Z

which surely appears to be working to me.

6

yes, both works, I had to rechecked my config, thanks :slight_smile:

{
      "@version" => "1",
       "FIELD_b" => "201901020",
       "message" => "",
    "@timestamp" => 2020-01-31T23:38:17.975Z,
       "FIELD_c" => 2019-01-02T23:00:00.000Z,
      "sequence" => 0
}
7

Thanks for this solution =)

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.