Removing seconds from time stamp field


(Dibyananda Senapati) #1

i want to make the seconds field from the timestamp field 2015-10-27T00:07:20.168+0000 in logstash 00 and create the new time stamp.
Could u please help me how can i achieve this.
From 2015-10-27T00:07:20.168+0000 to 2015-10-27T00:07:00.168+0000

regards
Dibya


(Dibyananda Senapati) #2

or also how can we make 2015-10-27T00:07:20 to 2015-10-27T00:07:00.
Anyways look forward to somebody's help on this


(Magnus Bäck) #3

You can e.g. use the mutate filter's gsub option. If there aren't any milliseconds or a timezone this should work:

mutate {
  gsub => ["timestamp", ":\d\d$", ":00"]
}

(Dibyananda Senapati) #4

But if there is a timezone and millisecond then how can i go about it


(Dibyananda Senapati) #5

my timestamp is like 2015-10-27T00:07:20.168+0000.
how can i do this to 2015-10-27T00:07:00.168+0000


(Magnus Bäck) #6

Well, it's basically the same. It's just that the seconds are followed by a period instead of the $ end-of-string marker. Don't forget that periods need to be escaped to be taken literally.


(Dibyananda Senapati) #7

thanks magnus .you are always a help. Let me try


(Dibyananda Senapati) #8

could you please give me the exact expression of gsub for my timestamp which is with millisecond and timezone


(Magnus Bäck) #9
mutate {
  gsub => ["timestamp", ":\d\d\.", ":00."]
}

(Dibyananda Senapati) #10

not working :cry:


(Dibyananda Senapati) #11

magnus, 1 more thing i want to tell.
I don't want to cut down time zone field . just want to change the seconds field to 00.


(Magnus Bäck) #12

Works just fine for me. Over and out.

$ cat test.config 
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
  mutate {
    gsub => ["message", ":\d\d\.", ":00."]
  }
}
$ echo '2015-10-27T00:07:20.168+0000' | /opt/logstash/bin/logstash -f test.config
Logstash startup completed
{
       "message" => "2015-10-27T00:07:00.168+0000",
      "@version" => "1",
    "@timestamp" => "2015-11-06T15:46:51.272Z",
          "host" => "lnxolofon"
}
Logstash shutdown completed

(Dibyananda Senapati) #13

you are right. I had missed the \


(system) #14