Hi everyone!
I have the following JSON doc:
{
"DataChangeInfo" : "Archive Log Set archiveLogSet.25933761.25933688",
"documentsList" : [
{
"commandScn": "25933758",
"commandCommitScn": "0",
"commandSequence": "3",
"commandType": "INSERT",
"commandTimestamp": "2017-12-07 05:09:54+03:000",
"objectDBName": "DB4",
"objectSchemaName": "CFTNA",
"objectId": "NEWJOU",
"changedFieldsList": [
{
"fieldId": "PK_NEWJOU",
"fieldType": "NUMBER",
"fieldValue": "NULL",
"fieldChanged": "Y"
},
{
"fieldId": "OFFICE",
"fieldType": "CHAR",
"fieldValue": "NULL",
"fieldChanged": "Y"
},
{
"fieldId": "UPDATE_DATE",
"fieldType": "DATE",
"fieldValue": "2017-12-07 05:09:54+03:000",
"fieldChanged": "Y"
},
{
"fieldId": "ENDDATE",
"fieldType": "DATE",
"fieldValue": "NULL",
"fieldChanged": "Y"
}
]
}
Now, "commandTimestamp": "2017-12-07 05:09:54+03:000" is the relevant field that I want to be saved as a date, and currently it's being saved as a string.
How can I do this?
It's not necessarily the field I want to be saved as @timestamp, but I want to aggregate by time in this field, and not as string.
I tried the following filter in logstash:
date{
match => ["[documentsList][commandTimeStamp]","yyyy-MM-dd HH:mm:ss","ISO8601","yyy-MM-dd HH:mm:ssZZZ","UNIX"]
target => ["new_timestamp"]
}
and I don't see any results or any new fields.
What am I doing wrong?
How can I do this?
Thanks!