Here's my message:
|cir=C2|date=29.03.2009 02:42:01|acronym=CEKLJ|libraryCode=50005|user=EZPROXY|type=57|transactionHostDepartment=01|membIdentificNumb=0051022|patronId=0051022|patronCategory=020|lastVisitDate=28.03.2009|schoolName=19|schoolDept=1|libraryDept=00|firstsignUpDate=09.11.2004
I'm using
mutate {
gsub => ["date", " ", ";"]
convert => {"type" => "integer"}
convert => {"rptPackageStatus" => "integer"}
add_field => {"country" => "si"}
}
To alter date before.