Logstash Filtering Grabbing Partial Date

Elastic Stack Logstash
1

date {
match => ["event_at", "yyyy-MM-dd'T'HH:mm:ss.SSSZ"]
}

How would i Grab just "yyyy-MM-dd'T'HH" and send it to a new field ?

2

Copy it to another field and then

mutate { gsub => [ "ts", "^(\d{4}-\d{2}-\d{2}T\d{2}).*", "\1" ] }

We use a capture group () to surround the part of the field we want to keep, and follow that with .* which will consume everything we do not want to keep. "\1" says to replace the text that the pattern matched (the entire field) with the contents of the first capture group.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.