Logstash: Replace @timestamp with time like this 2020-03-27T16:00:40.982652300+00:00

[Paul_Offord]

Hi, I need to replace the @timestamp value with a field value (called SystemTime) that looks like this:

2020-03-27T16:00:40.982652300+00:00

I have tried numerous variations of mutate gsub and the date filter but it's obvious I have no idea how to do this. Can someone please give me a steer?

Thanks and regards...Paul

[Badger]

I have not tested it but try

date { match => [ "SystemTime", "YYYY-MM-dd'T'HH:mm:ss.SSSSSSSSSZZ" ] }

[Paul_Offord]

@Badger

date { match => [ "SystemTime", "YYYY-MM-dd'T'HH:mm:ss.SSSSSSSSSZZ" ] }

Thanks for the quick response. I tried this and I get a "_dateparsefailure".

[Paul_Offord]

Actually, SystemTime appears like this in the console output:

    "SystemTime" => [
        [0] "2020-03-27T14:08:47.500000000+00:00"
    ]

How do I reference the array entry? I tried "SystemTime[0]" but this gives "Invalid FieldReference".

[Paul_Offord]

The input data is XML. I added force_array => false to the XML filter parameters, which stopped SystemTime being put into a single element array and your data filter then worked fine.

Thanks for the help.

[Badger]

@Paul_Offord

How do I reference the array entry? I tried "SystemTime[0]" but this gives "Invalid FieldReference".

It would be "[SystemTime][0]" if you were not using force_array => false.