Mask Output

Elastic Stack Logstash
1

Hi,

I have a logstash script that reads from an xml file and outputs a json file. It's all working well but I need to update the format of one of the fields.

Currently the field returns a time in HH:mm:ss format (15:00:00)

I need the output to just show HH:mm (15:00)

Can I do this with logstash? Here is my current code

if [checkOutBefore] { 
    mutate { replace => ["checkOutBefore", "%{[checkOutBefore][0]}"] }
}else{
    mutate { remove_field => ["checkOutBefore"] }
}
2

Use the mutate filter's gsub option.

mutate {
  gsub => ["checkOutBefore", ":\d\d$", ""]
}