Modify the string into another form in Logstash

[Pranjal_Sett]

Hello,

I am having one csv file, in that csv file there is a attribute named as Time field. And the format of that time field is not as a standard format.

Here is the format: [30/Nov/2017:15:28:27

And I want to change this format in Logstash to 30/Nov/2017 15:28:27. That means
[30/Nov/2017:15:28:27 => 30/Nov/2017 15:28:27

Can I do that in Logstash?

So that I will map this to in index template and give the custom date format!!

Thanks & Regards,
Pranjal Sett

[Badger]

@Pranjal_Sett

Can I do that in Logstash?

You can do it using mutate+gsub

mutate { gsub => [ "Time", "^\[", "", "Time", "\/(\d{4}):(\d{2})", "/\1 \2" ] }