How to read the date from multiline Json and covert the string to date


(Vignesh Kumar) #1

Have the following JSON object where i need to get the element and convert the string to date and traverse through the JSON,

{
"Client": {
"Client Name": "KM Jons",
"Portfolio": "Food and Beverage",
"ProcessName": "Sales"
},
"Sales":[
{
"StartTime": "20170926105415",
"Quantity": "100",
"location": "Seoul"
},
{
"StartTime": "20170926105418",
"Quantity": "100",
"location": "Singapore"
}
]
}

Have tried the following JSON config with ruby code as below,
input {
file {
type => "json"
path => "C:/ELK/data/Recordings/*.json"
start_position => beginning
codec => multiline {
pattern => "^{"
negate => "true"
what => "previous"
max_lines => 30000
}
}
}
filter{
mutate {
replace => { "message" => "%{message}}" }
gsub => [ 'message','\n','']
}

json { 
source => "message" 
remove_field => ["message"]
target => "wtfyo"
}

ruby {
code => "
event.get('[Sales]').each {|hash| event.set(hash['key'],hash['value'])}
"
}

}

output {
elasticsearch {
index => "test15"
}
stdout { codec => rubydebug }
}

Please help me to fix this and want to get the output as below,
{
"Client": {
"Client Name": "KM Jons",
"Portfolio": "Food and Beverage",
"ProcessName": "Sales"
},
"Sales":[
{
"StartTime": 2017-09-26T10:54:15.000Z,
"Quantity": "100",
"location": "Seoul"
},
{
"StartTime": 2017-09-26T10:54:18.000Z,
"Quantity": "100",
"location": "Singapore"
}
]
}


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.