Mutate date inside json

(Mike W) #1

I got json array inside one of the fields I'm going to store using logstash, and inside this arraythere is another field which contains a timestamp.

How do I access and mutate it?
I have tried the following:

match -> ["%{[org][users][login_date]}" => "YYYY-MM-dd HH:mm:ss.SSS"]

but it fails. I have also tried org.users.dates...., no success.

(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.