# Remove chars from Date/String

**URL:** <https://discuss.elastic.co/t/remove-chars-from-date-string/181461>\
**Category:** Logstash\
**Created:** [May 16, 2019, 5:49pm UTC](https://discuss.elastic.co/t/remove-chars-from-date-string/181461 "2019-05-16T17:49:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![schneider](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@schneider](https://discuss.elastic.co/u/schneider)\
**Post date:** [May 16, 2019, 5:49pm UTC](https://discuss.elastic.co/t/remove-chars-from-date-string/181461/1 "2019-05-16T17:49:03Z")

</div>

I want to remove "-03:00" from the input "2019 May 16 13:27:49 -03:00"  
The complet config is :

```
        input
        {
        	udp 
        	{
        		port => 5141 
        		type => "syslog"
        		tags => ["imsva"] 
        		codec => plain { charset=>"UTF-8" }

        	}
        }

filter
{
	if "imsva" in [tags]
	{
		csv 
		{
			source => "message"
            columns => 
			[ 
				"transacao","data1","data2","data3","campo5","id","id2","campo8","remetente",
				"destinatario","assunto","host_origen","host_destino","resposta_server",
				"status","campo16","campo17","campo18","data4","data5","campo21","campo22","anexo"
            ]
			separator => "#011"
        }
		
		date {
				match => ["data1", "yyy MMM dd HH:mm:ss"]
				target => "data1"
			}
		date{
				match => ["data3", "yyy MMM dd HH:mm:ss"]
				target => "data3"
			}
		date{
			match => ["data4", "yyy MMM dd HH:mm:ss"]
			target => "data4"
			}
		date{
			match => ["data5", "yyy MMM dd HH:mm:ss"]
			target => "data5"
			 } 

# mutate 
# {
# convert => ["transacao", "string"]
# convert => ["id", "string"]
# convert => ["campo5","string"]
# convert => ["id2","string"]
# convert => ["campo8","string"]
# convert => ["remetente","string"]
# convert => ["destinatario","string"]
# convert => ["assunto","string"]
# convert => ["host_origen","string"]
# convert => ["host_destino","string"]
# convert => ["resposta_server","string"]
# convert => ["status","string"]
# convert => ["campo16","string"]
# convert => ["campo17","string"]
# convert => ["campo18","string"]
# convert => ["campo21","string"]
# convert => ["campo22","string"]
# convert => ["anexo", "string"]
# }

        if "tjsc.jus.br" in [destinatario] 
		{		
			mutate 
			{
				add_field=>{"message_direction" => "incoming"}
			}
        }
        else{
				mutate
                {
					add_field=>{"message_direction" => "outgoing"}
                }
			} 
				
		mutate 
		{
			remove_field => ["message"]
		}
    }
}

output
{
	if "imsva" in [tags]
	{
		elasticsearch
		{
			index => "imsva_message"
			hosts => "localhost:9200"
        }
	}
}

```

`And the input is :`

```
NormalTransac#0112019 Apr 29 13:31:00 -03:00#0112019/04/29 13:31:02 -03:00#0112019 
Apr 29 13:31:02 -03:00#0111556555451331.83794@tjsc.jus.br#0117258FCC2-87AD-CF05-831F-A6E84C2A914E#01149E9F2C6A1#0112#011matheus.trevisol@tjsc.jus.br#011dpicara@pc.sc.gov.br#011Encaminha documentação - relativo descumprimento medidas#011svmnt-beexc-01.tjsc.ad[10.18.12.78]#011smtp.sc.gov.br[200.19.215.15]:25#011250 2.0.0 Ok: queued as 6C8FC1D207E#011sent#01100100000000000000#0110#011#0112019 Apr 29 13:31:02 -03:00#0112019 Apr 29 13:31:01 -03:00#011#0113#011intimação Rodrigo de Oliveira autos 2915-02.pdf; pedido e decisão Rodrigo de Oliveira autos 2915-02.pdf
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 16, 2019, 7:59pm UTC](https://discuss.elastic.co/t/remove-chars-from-date-string/181461/2 "2019-05-16T19:59:39Z")

</div>

Please edit your post, select the configuration, and click on \</\> in the toolbar above the edit pane. You should see a significant change in the preview pane to the right. Then do the same for the input.

---

<div class="post-metadata">

**Author:** ![schneider](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@schneider](https://discuss.elastic.co/u/schneider)\
**Post date:** [May 20, 2019, 4:47pm UTC](https://discuss.elastic.co/t/remove-chars-from-date-string/181461/3 "2019-05-20T16:47:28Z")

</div>

Its working, this is the configure:

```
input 
{
	udp 
	{
		port => 5141 
		type => "syslog"
		tags => ["imsva"] 
		codec => plain { charset=>"UTF-8" }

	}
}

filter
{
	if "imsva" in [tags]
	{
		csv 
		{
			source => "message"
            columns => 
			[ 
				"transacao","data1","data2","data3","campo5","id","id2","campo8","remetente",
				"destinatario","assunto","host_origen","host_destino","resposta_server",
				"status","campo16","campo17","campo18","data4","data5","campo21","campo22","anexo"
            ]
			separator => "#011"
        }
		
		csv
		{
			source => "data1"
			columns => 
			[
				"data_1","fuso_horario_1"
			]
			separator => " -03"
		
		}
		
		csv
		{
			source => "data2"
			columns => 
			[
				"data_2","fuso_horario_2"
			]
			separator => " -03"
		
		}
		
		csv
		{
			source => "data3"
			columns => 
			[
				"data_3","fuso_horario_3"
			]
			separator => " -03"
		
		}
		
		csv
		{
			source => "data4"
			columns => 
			[
				"data_4","fuso_horario_4"
			]
			separator => " -03"
		
		}
		
		csv
		{
			source => "data5"
			columns => 
			[
				"data_5","fuso_horario_5"
			]
			separator => " -03"
		
		}
		
# date {
# match => ["data_1", "yyyy MMM dd HH:mm:ss"]
# match => ["data_3", "yyyy MMM dd HH:mm:ss"]
# match => ["data_4", "yyyy MMM dd HH:mm:ss"]
# match => ["data_5", "yyyy MMM dd HH:mm:ss"]
# } 

        if "tjsc.jus.br" in [destinatario] 
		{		
			mutate 
			{
				add_field=>{"message_direction" => "incoming"}
			}
        }
        else{
				mutate
                {
					add_field=>{"message_direction" => "outgoing"}
                }
			} 
				
		mutate 
		{
			remove_field => ["message"]
			remove_field => ["data1"]
			remove_field => ["data2"]
			remove_field => ["data3"]
			remove_field => ["data4"]
			remove_field => ["data5"]
			remove_field => ["fuso_horario_1"]
			remove_field => ["fuso_horario_2"]
			remove_field => ["fuso_horario_3"]
			remove_field => ["fuso_horario_4"]
			remove_field => ["fuso_horario_5"]
		}
    }
}

output
{
	if "imsva" in [tags]
	{
		elasticsearch
		{
			index => "imsva_message"
			hosts => "localhost:9200"
        }
	}
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 20, 2019, 5:27pm UTC](https://discuss.elastic.co/t/remove-chars-from-date-string/181461/4 "2019-05-20T17:27:23Z")

</div>

You could remove them before the csv filter.

```
mutate { gsub => ["message", " -03:00", ""] }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2019, 5:27pm UTC](https://discuss.elastic.co/t/remove-chars-from-date-string/181461/5 "2019-06-17T17:27:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.