Hey Guys,
In my CVS the Year and Month are seperated. How do i merge these together so that they both used as the timestamp?
hi @luckyluke
this is more of a question on the ingest/logstash side.
On the logstash side:
Here's an example on how to do this https://stackoverflow.com/questions/44376416/concat-3-columns-in-csv-how-to-do-this (see the explanation wrt mutate)
If your data is already indexed, you can create a new field in your mapping, and concatenate using the set processor https://www.elastic.co/guide/en/elasticsearch/reference/master/set-processor.html . For that, here's an example on SO as well https://stackoverflow.com/questions/54864854/create-a-keyword-field-concatenated-of-other-fields . You can just reindex with that pipeline you've created https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.