Reversing The Order Of Characters to a date valid format

[Claudio_Ract_Costa]

Hi guys,

Does anyone know how can I reverse the order of the number bellow to transform it in a valid date format ?

I am trying to figure out how do it using mutate gsub or ruby but it is very complex.

from:
024042315405313000

to:
200424134550130300

And then to a valid date format:
2020-04-24T13:45:50.130Z

I need that because, unfortunately, my field comes in this format

"time_triggertime_occ":"024042315405313000"

[Badger]

Using mutate+gsub you could reverse a pair of characters using something like

mutate { gsub => { "someField", "(.)(.)(.*)", "\2\1\3" ] }

[Claudio_Ract_Costa]

Hello Badger,

I was studying this piece of code.
Each "(.)" is a block with one char and you use "\1", "\2", ... to indicate each block.

Just one problem ... when I have to indicate a block greater than 9, for example, "\10", gsub get "\1" block and after, insert "0"

For example, the code:

gsub => [ "time_triggertime_occ", "(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)", "\2\1\4\3\6\5\8\7'\10'\9" ]

have the following output:

"time_triggertime_occ" => "20042407'00'8",

the original value is:

      "time_triggertime_occ" => "024042708443313000",

do you know how can i fix it ? (sorry for my english)

[Badger]

After a lot of Googling and searching of forums I have learned the following: Back-references to numbered captures in Ruby regexps are limited to 9. If you want more you will have to use named captures.

For example

input { generator { count => 1 lines => [ 'abcdefghijkl' ] } }
filter {
    mutate {
        gsub => [
            "message",
            "(?<d1>.)(?<d2>.)(?<d3>.)(?<d4>.)(?<d5>.)(?<d6>.)(?<d7>.)(?<d8>.)(?<d9>.)(?<d10>.)(?<d11>.)(?<d12>.)",
            "\k<d1> \k<d2> \k<d3> \k<d4> \k<d5> \k<d6> \k<d7> \k<d8> \k<d9> \k<d10> \k<d11> \k<d12>"
        ]
    }

will result in

   "message" => "a b c d e f g h i j k l",

[Claudio_Ract_Costa]

Espetacular, Badger !

It worked !! Thanks my friend !!

Bellow is the final code:

   mutate {
        gsub => [
            "time_triggertime_occ",
            "(?<d1>.)(?<d2>.)(?<d3>.)(?<d4>.)(?<d5>.)(?<d6>.)(?<d7>.)(?<d8>.)(?<d9>.)(?<d10>.)(?<d11>.)(?<d12>.)(?<d13>.)(?<d14>.)(?<d15>.)(?<d16>.)(?<d17>.)(?<d18>.)",
            "20\k<d2>\k<d1>-\k<d4>\k<d3>-\k<d6>\k<d5>T\k<d8>\k<d7>:\k<d10>\k<d9>:\k<d12>\k<d11>.\k<d14>\k<d13>0-\k<d16>\k<d15>\k<d18>\k<d17>"
        ]
    }

The output was:

"time_triggertime_occ" => "2020-04-24T07:48:34.130-0300",