Ruby Filter Exception

[fadihaddad (fadi)]

hello, I am using this ruby filter to transform and map my data into a new field
Dalist : "8~103511~0~103511~20181209|23~2660000~2382761~277239~20181209"
transforming it to DAList => [
[0] {
"DA_ID" => "8",
"DA_Before" => "275273",
"DA_Change" => "1687",
"DA_After" => "273586",
"DA_ExpDate" => "20181209"
},
[1] {
"DA_ID" => "23",
"DA_Before" => "2660000",
"DA_Change" => "0",
"DA_After" => "2660000",
"DA_ExpDate" => "20181209"
}
],
I used this ruby filter code to also map the nested fields`
ruby {
code => "
x = event.get('dAList').split('|').collect { |t|
c = t.split '~'
{
'DA_ID' => c[0].to_i,
'DA_Before' => c[1].to_i,-
'DA_After' => c[2].to_i,
'DA_Change' => c[3].to_i,
'DA_ExpDate' => Time.strptime(c[4], '%Y%m%d')
}
}
event.set('DAList', x)

"
}
`

my first problem is that some documents are being throwed because they are not parsing the date Format of DA_ExpDate giving this error \\01/25/19\\ is malformed at \"/25/19\""
and how can I set the time zone the the DA_ExpDate

[Badger]

If there are multiple formats you might be better off with a date filter. That also handle timezones.

date {
    match => [ "[DAList][0][DA_ExpDate]", "YYYYMMdd", "MM/dd/YY" ]
    target => "[DAList][0][DA_ExpDate]"
    timezone => "Asia/Qyzylorda"
}
date {
    match => [ "[DAList][1][DA_ExpDate]", "YYYYMMdd", "MM/dd/YY" ]
    target => "[DAList][1][DA_ExpDate]"
    timezone => "Asia/Qyzylorda"
}

[fadihaddad (fadi)]

can I use 1 date filter for dynamic instead of [0],[1],[2],[3]…..etc

[Badger]

No. Unfortunately the date filter does not accept an array of strings as an input (and return an array of timestamps). You either have multiple date filters, or start implementing a significantly more complex ruby filter that tests against multiple date formats and handles timezones.

[fadihaddad (fadi)]

okay thank you so much for your help