Logstash Filtering Grabbing Partial Date

date {
match => ["event_at", "yyyy-MM-dd'T'HH:mm:ss.SSSZ"]

How would i Grab just "yyyy-MM-dd'T'HH" and send it to a new field ?

Copy it to another field and then

mutate { gsub => [ "ts", "^(\d{4}-\d{2}-\d{2}T\d{2}).*", "\1" ] }

We use a capture group () to surround the part of the field we want to keep, and follow that with .* which will consume everything we do not want to keep. "\1" says to replace the text that the pattern matched (the entire field) with the contents of the first capture group.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.