Indexing date from a field with two entries


(aviv ratzon) #1

Hello,
I am parsing a log file and got to a point where I have this field:

"Date":["27/10/2015","10:09:01"]

I can't seem to preform a date filter on it in any way, I've tried different configurations and nothing. I also couldn't find a way to merge the two entries into one.
any help will be greatly appreciated : )


(Magnus B├Ąck) #2

See below on how to merge fields. To access the elements of the array you have, use %{[Date][0]} and %{[Date][1]}.


(aviv ratzon) #3

great, much appreciated!


(system) #4