Reversing The Order Of Characters to a date valid format

Hi guys,

Does anyone know how can I reverse the order of the number bellow to transform it in a valid date format ?

I am trying to figure out how do it using mutate gsub or ruby but it is very complex.



And then to a valid date format:

I need that because, unfortunately, my field comes in this format :frowning:


Using mutate+gsub you could reverse a pair of characters using something like

mutate { gsub => { "someField", "(.)(.)(.*)", "\2\1\3" ] }

Hello Badger,

I was studying this piece of code.
Each "(.)" is a block with one char and you use "\1", "\2", ... to indicate each block.

Just one problem ... when I have to indicate a block greater than 9, for example, "\10", gsub get "\1" block and after, insert "0"

For example, the code:

gsub => [ "time_triggertime_occ", "(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)", "\2\1\4\3\6\5\8\7'\10'\9" ]

have the following output:

"time_triggertime_occ" => "20042407'00'8",

the original value is:

      "time_triggertime_occ" => "024042708443313000",

do you know how can i fix it ? (sorry for my english)

After a lot of Googling and searching of forums I have learned the following: Back-references to numbered captures in Ruby regexps are limited to 9. If you want more you will have to use named captures.

For example

input { generator { count => 1 lines => [ 'abcdefghijkl' ] } }
filter {
    mutate {
        gsub => [
            "\k<d1> \k<d2> \k<d3> \k<d4> \k<d5> \k<d6> \k<d7> \k<d8> \k<d9> \k<d10> \k<d11> \k<d12>"

will result in

   "message" => "a b c d e f g h i j k l",
1 Like

Espetacular, Badger !

It worked !! Thanks my friend !!

Bellow is the final code:

   mutate {
        gsub => [

The output was:

"time_triggertime_occ" => "2020-04-24T07:48:34.130-0300",

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.