I need to leave a string field in the date field. I've done several things but I'm not sure how to do it. Follow my files

Elastic Stack Logstash
1

I need to leave a string field in the date field.

I've done several things but I'm not sure how to do it.

Follow my files.

input{
 file{
  path => "/etc/logstash/unico/FM099-Registro\ de\ Indisponibilidade\ -\ 2021.xlsx.csv"
  type => "tjce-csv"
  start_position => "beginning"
  #mode => "read"
  #sincedb_path => "NULL"
  #exit_after_readeditar => "true"
 }
}
filter {
 if [type] == "tjce-csv" {
  csv{
   columns => ["host","data","horainicio","horafim","tempodown","problema","ovservador"]
  }
  ruby{
   code => "
    if event.get('problema').nil?
     event.cancel
    end
    if event.get('problema') == 'Motivo'
     event.cancel
    end
   "
  }
  ruby{
   code => "
#a = event.get('data').gsub('/',' ')
    a = event.get('data')
    sep = a.split('/')
#sep.each_index { |x|
#event.set('statusref',b[x])
#  }
    dia = sep[0]
    mes = sep[1]
    ano = sep[2]
#    dt = ano+'-'+mes+'-'+dia+'T'+event.get('horainicio')+'Z'
  dt = ano+'-'+mes+'-'+dia+' '+event.get('horainicio')
#       event.set('t',ano+' '+mes+' '+dia)
#       a << ' '
#       a << event.get('horainicio')
    event.set('time',dt)
    event.set('time3',{'date' => dt})
#       b = a.split('-')
#       event.set('bb',b)
#       event.set('time2',a.to_datetime)
   "
  }

#       mutate {convert => ["time", "date"]}
#       date {
#        match => [ "time", "yyyy-MM-dd HH:mm:ss" ]
#      }
 }
}

{
  "_index": "XXXXX",
  "_type": "_doc",
  "_id": "D1EKXXXXXO4Y8wz",
  "_version": 1,
  "_score": null,
  "_source": {
    "time3": {
      "date": "2021-24-2 17:14:00"
    },
    "host": "TACTIUM",
    "tempodown": "00:31:00",
    "time": "2021-24-2 17:14:00",
    "message": "TACTIUM,2/24/2021,17:14:00,17:45:00,00:31:00,Central tactium API da Khomp no Tactium parou.,Responsavel Acyr,\r",
    "ovservador": "XXXXX",
    "column8": null,
    "@timestamp": "2021-03-10T12:09:05.488Z",
    "horafim": "17:45:00",
    "horainicio": "17:14:00",
    "path": "/etc/logstash/unico/FM099-Registro de Indisponibilidade - 2021.xlsx.csv",
    "type": "XXXXX",
    "problema": "Central tactium API da Khomp no Tactium parou.",
    "@version": "1",
    "data": "2/24/2021"
  },
  "fields": {
    "@timestamp": [
      "2021-03-10T12:09:05.488Z"
    ]
  },
  "sort": [
    1615378145488
  ]
}

I would like this field to be the same as that of the 'time'
image

2

If you are saying that you want the [@timestamp] field to have the value from the [time] field then use a date filter

date { match => [ "[time]", "YYYY-d-M HH:mm:ss" ] }
3

Thanks, I did the procedure and it worked out to put it on @timestamp, however my goal was for it to be a date type field but as a 'time' name

4

You could try

date { match => [ "[time]", "YYYY-d-M HH:mm:ss" ] target => "time" }
1 Like
5

Thank you very much! it worked out

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.