Mask Output

(James Privett) #1


I have a logstash script that reads from an xml file and outputs a json file. It's all working well but I need to update the format of one of the fields.

Currently the field returns a time in HH:mm:ss format (15:00:00)

I need the output to just show HH:mm (15:00)

Can I do this with logstash? Here is my current code

if [checkOutBefore] { 
    mutate { replace => ["checkOutBefore", "%{[checkOutBefore][0]}"] }
    mutate { remove_field => ["checkOutBefore"] }

(Magnus B├Ąck) #2

Use the mutate filter's gsub option.

mutate {
  gsub => ["checkOutBefore", ":\d\d$", ""]

(system) #3