Logstash deal with 24:00 time representation

Elastic Stack Logstash
1

Hello,

I have a dataset containing a datetime representation like this MM/01/yyyy 24:00 instead of MM/02/yyyy 00:00 or MM/01/yyyy 23:59
So the end of the day is represented as 24:00 and therefore not recognized by Elastcisearch/Kibana as the @timestamp (which is desired).
How can I change it accordingly?
Thanks in advance!

2

If you are parsing it with a date filter one option would be to mutate+gsub 24:00 to 23:59 before the date filter, and optionally use a ruby filter conditional upon the presense of 24:00 in the original field to add 60 seconds to the resulting date (using code similar to this).

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.