JSON date conversion

Elastic Stack Logstash
1

Is there an easy way for logstash to convert a date form json date format to a readable format? and put it back in the same variable?

the date comes in like {"srcdate":"/Date(1164258000000)/"}

I would like to get the date into the format MM/dd/YYYY

I am using logstash 2.2.0

2

There is no "JSON date format". What does 1164258000000 mean? It doesn't appear to be either seconds or milliseconds since the epoch.

3

I am using powershell to output the json it provides the date.

here is the powershell script to get their date information
Code:
$test = get-date
$test1=$test | convertto-json

$test
$test1

Output:
Wednesday, December 14, 2016 8:38:33 AM
{
"value": "/Date(1481722713595)/",
"DisplayHint": 2,
"DateTime": "Wednesday, December 14, 2016 8:38:33 AM"
}

Also I am using logstash 2.2.0

4

Okay, but I still don't understand what that number represents.

5

this syntax works in powershell and formats into the number of milliseconds.

$target = "2/2/2014 6:32 PM"
[int64]((get-date $target).addhours((([datetime]::UtcNow)-(get-date)).Hours)-(get-date "1/1/1970")).totalmilliseconds

It was taken from http://stackoverflow.com/questions/26067906/format-a-datetime-in-powershell-to-json-as-date1411704000000

Basically the converto-json function in powershell converts it to value": "/Date(1481722713595)/", which is valid json but not a valid date for logstash or elastic to use. I have written some code to alleviate this but it is basically loop and very expensive. I did not know if there was a way for logstash to manipulate the date and put it back into the same variable.

Data will come in like

"startdate": "/Date(1481722713595)/",
"enddate": "/Date(1481722713595)/",

I guess I would need logstash to look at the field and determine the correct date.

the regex pattern match would be something like this '("\/\w*\W\d*\W\/")'

This converts the date back in powershell I have to test for negative dates as well.
#negative test
$mydate = {"/Date(-366235200000)/"}|convertfrom-json
$mydate1 ="$($mydate.toshortdatestring())"
$mydate1

positive test

$mydate = {"/Date(1174363200001)/"}|convertfrom-json
$mydate1 ="$($mydate.toshortdatestring())"
$mydate1

6

this syntax works in powershell and formats into the number of milliseconds.

Good. You should be able to use a date filter with a UNIX_MS pattern to parse it.

I guess I would need logstash to look at the field and determine the correct date.

Use a grok filter to extract the number into a field of its own, then use a date filter (with a UNIX_MS pattern) to parse the timestamp.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.