How to test if fieldNames contains specific caracter?

[Isilve28]

Hello everyone,

I want to use date filter for every fieldName ending with "Date" (and keeping the value in the same fieldName) because I'm using a kv filter at first and I don't know all the time if a field is numeric or temporal.

is there a syntax to test filedNames in Logstash ?

Thanks in advance !

[Badger]

You can do it in ruby. For example,

input { generator { count => 1 message => '' } }
filter {
    mutate { add_field => { "someDate" => "2018-10-29 23:02:40" } }
    ruby {
        code => '
            event.to_hash.each { |k, v|
                if k.end_with? ("Date")
                    newv = Time.strptime(v, "%Y-%m-%d %H:%M:%S")
                    event.set(k, newv)
                end
            }
        '
    }
}
output { stdout {} }

gives me

  "someDate" => 2018-10-30T03:02:40.000Z,