Removing seconds from time stamp field

Elastic Stack Logstash
1

i want to make the seconds field from the timestamp field 2015-10-27T00:07:20.168+0000 in logstash 00 and create the new time stamp.
Could u please help me how can i achieve this.
From 2015-10-27T00:07:20.168+0000 to 2015-10-27T00:07:00.168+0000

regards
Dibya

2

or also how can we make 2015-10-27T00:07:20 to 2015-10-27T00:07:00.
Anyways look forward to somebody's help on this

3

You can e.g. use the mutate filter's gsub option. If there aren't any milliseconds or a timezone this should work:

mutate {
  gsub => ["timestamp", ":\d\d$", ":00"]
}
4

But if there is a timezone and millisecond then how can i go about it

5

my timestamp is like 2015-10-27T00:07:20.168+0000.
how can i do this to 2015-10-27T00:07:00.168+0000

6

Well, it's basically the same. It's just that the seconds are followed by a period instead of the $ end-of-string marker. Don't forget that periods need to be escaped to be taken literally.

7

thanks magnus .you are always a help. Let me try

8

could you please give me the exact expression of gsub for my timestamp which is with millisecond and timezone

9 
mutate {
  gsub => ["timestamp", ":\d\d\.", ":00."]
}
10

not working :cry:

11

magnus, 1 more thing i want to tell.
I don't want to cut down time zone field . just want to change the seconds field to 00.

12

Works just fine for me. Over and out.

$ cat test.config 
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
  mutate {
    gsub => ["message", ":\d\d\.", ":00."]
  }
}
$ echo '2015-10-27T00:07:20.168+0000' | /opt/logstash/bin/logstash -f test.config
Logstash startup completed
{
       "message" => "2015-10-27T00:07:00.168+0000",
      "@version" => "1",
    "@timestamp" => "2015-11-06T15:46:51.272Z",
          "host" => "lnxolofon"
}
Logstash shutdown completed
13

you are right. I had missed the \