# Mutate or reformat Winlogbeat timestamp

**URL:** <https://discuss.elastic.co/t/mutate-or-reformat-winlogbeat-timestamp/88412>\
**Category:** Logstash\
**Created:** [June 6, 2017, 12:31pm UTC](https://discuss.elastic.co/t/mutate-or-reformat-winlogbeat-timestamp/88412 "2017-06-06T12:31:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jalcock](https://avatars.discourse-cdn.com/v4/letter/j/ea5d25/32.png) [@jalcock](https://discuss.elastic.co/u/jalcock)\
**Post date:** [June 6, 2017, 12:31pm UTC](https://discuss.elastic.co/t/mutate-or-reformat-winlogbeat-timestamp/88412/1 "2017-06-06T12:31:21Z")

</div>

Hello,

I am ingesting winlogbeat to Logstash. For specific events, I am outputting those events to a third party SIEM.

The @timestamp field is set to YYYY-MM-DDTHH:MM:SS.milliZ

Is it possible to reformat/mutate the field (or create a new field) to remove the T, millisecond, and Z offset? Is this a gsub or date filter solution? I am outputting the events using a specific codec to use the third party plugins for log parsing.

Apologies if this is blindingly obvious as I've been looking around and swear I must be missing something.

Would you use the date filter to match the above format, add a new field, and set the date filter target to that new field....then is it possible to mutate that field once it is set to a date field?

date {  
match =\> { "@timestamp", "YYYY-MM-ddTHH:mm:ss.SSSZ" }  
add\_field =\> { "mynewtimestamp" }  
target =\> { "mynewtimestamp" }  
}  
[insert some sort of mutate that I don't know]

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 8, 2017, 7:40pm UTC](https://discuss.elastic.co/t/mutate-or-reformat-winlogbeat-timestamp/88412/2 "2017-06-08T19:40:21Z")

</div>

The date filter produces timestamps in a particular format. You'll have to use a ruby filter to write a piece of Ruby code to format the timestamp in another way. This might work (adjust time pattern to taste):

```
event.set('mytimestamp', event.get('@timestamp').time.strftime('%Y-%m-%d %H:%M:%s'))
```

---

<div class="post-metadata">

**Author:** ![jalcock](https://avatars.discourse-cdn.com/v4/letter/j/ea5d25/32.png) [@jalcock](https://discuss.elastic.co/u/jalcock)\
**Post date:** [June 12, 2017, 1:23pm UTC](https://discuss.elastic.co/t/mutate-or-reformat-winlogbeat-timestamp/88412/3 "2017-06-12T13:23:34Z")

</div>

Thank you, this is exactly what I need.

**DISREGARD**

I updated the code as it was outputting milliseconds instead of seconds.

Working code:

```
ruby {
    code => "event.set('mytimestamp', event.get('@timestamp').time.strftime('%Y-%m-%d %H:%M:%S'))"
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2017, 1:24pm UTC](https://discuss.elastic.co/t/mutate-or-reformat-winlogbeat-timestamp/88412/4 "2017-07-10T13:24:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.