Remove space from date string

[CraigFoote]

I have a field named 'datetime' that is a string with a space between the date and the time (ISO8601 with a space instead of a 'T'). I need the date portion to use in another field. I've tried this:

mutate{
add_field => { "date_only" => "%{datetime}" }
gsub => [ "date_only", " .*", "" ]
}

I've also tried for the gsub pattern "\s.*" and doubleslash+s but in all cases the time is not removed from date_only. What am I doing wrong?

Craig

[CraigFoote]

The solution was to break the steps up into two mutate blocks.

[wwalker (Walker)]

I've run into this same issue mutliple times. It appears that the order of operations as input into the config file does not matter. Each plugin appears to perform its specific operations first and then common operations are performed last. It would be nice if plugins performed operations based on how they are entered into the config file but I could also see that opening a whole can of worms for a lot of people.