Mutate gsub - re-using regex

[JimJ]

Hi everybody,

I would like to parttially remove the end of a string like that:

mutate {
        gsub => [
          "fieldname", "(:[0-5][0-9].\d{3})\d*$", "what_is_between_brackets"
        ]
      }

Context: I parse dates that can contain more than millisecond as decimal (4 to 5 digits after the decimal point).

But the date plugin can only manage date up to milliseconds and fails if there is more than 3 digits after the decimal point.

So, the idea is to gsub the string removing digits after the third.

Any suggestion is welcome.

[leandrojmp (Leandro Pereira)]

What does your field looks like? Can you give an example of the values?

I have a similar case with a field that has unix epoch time with a precision in the microseconds or more, I use the truncate filter to keep only the milisecond precison.

This is what I do:

truncate {
    fields => "[@metadata][timestamp]"
    length_bytes => 13
}

Maybe you can do something similar depending on how does your field looks like.

[JimJ]

Hi Leandro,

This is an example:
2021-09-28 10:33:08.0454
So, this should do the trick:

truncate {
    fields => "my_field"
    length_bytes => 23
}

Okay, thank you for this.
I'll apply it to my logstash filter.