# Sprintf +FORMAT Field Reference

**URL:** https://discuss.elastic.co/t/sprintf-format-field-reference/184226
**Category:** Logstash
**Created:** [June 4, 2019, 4:15pm UTC](https://discuss.elastic.co/t/sprintf-format-field-reference/184226 "2019-06-04T16:15:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![josh\_jacques](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@josh\_jacques](https://discuss.elastic.co/u/josh_jacques)
#### Post date: [June 4, 2019, 4:15pm UTC](https://discuss.elastic.co/t/sprintf-format-field-reference/184226/1 "2019-06-04T16:15:53Z")

</div>

Under the **sprintf** section of **Accessing Event Data and Fields in the Configuration** in the logstash reference. There is mention of being able to use a +FORMAT to format the @timestamp..in their example they mention using it for outputting logs to a file based on the events date and hour.  
[https://www.elastic.co/guide/en/logstash/7.1/event-dependent-configuration.html#sprintf](https://www.elastic.co/guide/en/logstash/7.1/event-dependent-configuration.html#sprintf)

Lets take for instance, the following config...

```
input {
  stdin { }
}

filter {
  mutate {
    add_field => {
      "[date_pattern]" => "+YYYY.MM"
    }
  }

  mutate {
    add_field => {
      "[year_month]" => "%{[date_pattern]}"
      "[year_month2]" => "%{+YYYY.MM}"
    }
  }
}

output {
  stdout {
    codec => rubydebug
  }
}

```

Followed by the results...

```
{
      "year_month" => "+YYYY.MM",
     "year_month2" => "2019.06",
      "@timestamp" => 2019-06-04T16:11:38.858Z,
    "date_pattern" => "+YYYY.MM",
        "@version" => "1",
            "host" => "test.server.com",
         "message" => ""
}

```

I was hoping that **year\_month** would have expanded **date\_pattern** and would yield the same result as **year\_month2**.

Thoughts?

Is there a way to achieve this?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 4, 2019, 5:36pm UTC](https://discuss.elastic.co/t/sprintf-format-field-reference/184226/2 "2019-06-04T17:36:27Z")

</div>

> [@josh\_jacques](#):
>
> Is there a way to achieve this?

I don't think so. If I am reading the [code](https://github.com/elastic/logstash/blob/ee2e4ad2861f846ef7e651c6e883efd6fe7230d7/logstash-core/src/main/java/org/logstash/StringInterpolation.java#L49) correctly it is either/or (well, if/else to be literal).

---

<div class="post-metadata">

### Author: ![josh\_jacques](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@josh\_jacques](https://discuss.elastic.co/u/josh_jacques)
#### Post date: [June 4, 2019, 8:46pm UTC](https://discuss.elastic.co/t/sprintf-format-field-reference/184226/3 "2019-06-04T20:46:23Z")

</div>

@Badger  
Thank you for the reply, it's much appreciated. I am certainly no programmer/developer, so much of that code looks very confusing to me.

For what it's worth, I was initially trying to use the translate filter, with those different date formats, but knowing it's not possible to perform the action as I had hoped, I went the route of using some if statements.

Thanks again.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 2, 2019, 8:46pm UTC](https://discuss.elastic.co/t/sprintf-format-field-reference/184226/4 "2019-07-02T20:46:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.