I want to convert my date format yyyymmdd into month name date and year like mmm dd yyy (Apr 30 2012)

Elastic Stack Logstash
1

Hi

I am having a log like the below

<#> 20200924 15:14:40.918 280018000 EV.INF [ MVINB-LSL2.T1G1_ATMTH_SL main.main TSP1.T1G1_ATMTH_SL ] Process T1G1_ATMTH_SL starting in progress...

in the above log , i want to convert my date (20200924) to string Sep 24 2020 in the kibana. Is there any way please help me on this.

Thanks and Regards,
M.Lokesh

2

I assume you would have a date field in your elasticsearch. Some ways to covert your date .

  1. You can parse your log to convert date to "Sep 24 2020" format before sending to Elasticsearch.
  2. Keep your date field format as "20200924" and convert it when showing in Kibana using painless script.
3

Hi @wangqinghuan Thank you for your reply.

Can i know what is the script to convert this date format "20200924" to "Sep 24 2020" . Can i make these script in the scripted field of kibana.

4

Convert date before index need you make some change code when you indexing document, such as following Java code:
Date rawDate = new SimpleDateFormat('yyyymmdd).parse('20200924');
String newDate = new SimpleDateFormat('Mon dd yyyy).format(rawDate);
Convert date when quering need you make some painless script, which is a language similar to Java. Although Kibana provides interface to help you create scripted fields.

5

@wangqinghuan Can write like this in logstash.conf. here i am giving a file consisting of a list of logs that i litsed above as the input

input{

stdin {

 }

}

filter {

grok{

match=>{

"message"=> "%{INT:log_date}\s*%{TIME:time}\s*\s*%{INT:event_id}\s*\s*%{GREEDYDATA:event_type}\s*\s*[\s*\s*%{HOSTNAME:host_name}.%{USERNAME:Process_name}\s%{HOSTNAME:thread}\s*\s*\s*\s*\s*\s*%{USERNAME:logger_name}\s*\s*\s*\s*\s*]\s*\s*%{GREEDYDATA:message}"

}

}

Date rawDate = new SimpleDateFormat('yyyymmdd).parse('log_date');

String newDate = new SimpleDateFormat('Mon dd yyyy).format(rawDate);

}

output {

elasticsearch {

  hosts => ["127.0.0.1:9200"]

  index => "sattestingdatedate"

}

}

6

When using Logstash, you could only use ruby filter to change your date format.

7 
filter{
ruby{
init => 'require "time"'
code => "event.set('log_date',Date.strptime(log_date, '%Y%m%d').strftime('%b %d %Y'))"
}
}
8

@wangqinghuan i am getting this error

[2020-11-14T22:16:08,990][ERROR][logstash.filters.ruby ][main][a81999a732f4939fea3b072754eb61bc46abe723ddf4bf4bfa4435a07b09da48] Ruby exception occurred: undefined local variable or method `log_date' for #LogStash::Filters::Ruby:0x420cd67

9

Try

code => "event.set('log_date',Date.strptime(event.get(log_date), '%Y%m%d').strftime('%b %d %Y'))"
10

@wangqinghuan i tried but still getting same error

[2020-11-14T22:33:00,647][ERROR][logstash.filters.ruby ][main][f60c6fd2ea6c1769405562d564f475d434cff8f60d85d2571597332021f0d998] Ruby exception occurred: undefined local variable or method `log_date' for #LogStash::Filters::Ruby:0x5e61d649

11

Hi,
This is pseudocode . You should make some change combine your exsiting data.

12

Ok. Got It . Thank you so much @wangqinghuan :smiling_face_with_three_hearts:

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.