How to set a value in timestamp

Elastic Stack Logstash
1

I have two values as my date and hour data and i want them to be my timestamp:

"F-MESSAGE-CAB": "20221018","H-MESSAGE-CAB": "601006"
"F-MESSAGE-CAB": "20221018","H-MESSAGE-CAB": "1338311"

What i'm trying to do is putting them together into one value and then overwrite the timestamp value but it doesn't work, i had tried with different date formats but the timestamp doesn't change from the actual date

This is the code

	mutate{
		add_field => {
			"DATE" => "%{F-MESSAGE-CAB}%{H-MESSAGE-CAB}" 
		}
	}
	date{
		match => ["DATE", "yyyy-MM-dd h:mm:ss"]
		target => "@timestamp"
	}

}
2

What does that number represent?

3

It's the hour "1338311" as 13:38:311

4

Try this:

5

Is that 311 seconds, or 31.1?

6

31.1 seconds

7 
    ruby { code => 'event.set("H-MESSAGE-CAB", event.get("H-MESSAGE-CAB").to_s.rjust(7, "0"))' }
    mutate { add_field => { "[@metadata][date]" => "%{F-MESSAGE-CAB} %{H-MESSAGE-CAB}" } }
    date{ match => ["[@metadata][date]", "yyyyMMdd HHmmssS"] }

will produce

{
"H-MESSAGE-CAB" => "0601006",
"F-MESSAGE-CAB" => "20221018", 
   "@timestamp" => 2022-10-18T10:01:00.600Z, ...
}
{
"H-MESSAGE-CAB" => "1338311",
"F-MESSAGE-CAB" => "20221018",
   "@timestamp" => 2022-10-18T17:38:31.100Z, ...
2 Likes
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.