String field to date, parsing from xpath

[daian.martinho]

Hi,

I'm trying to parse string field as date.

i got the value from an xml using xpath..

 xpath =>[                            
       "/ReportHost/HostProperties/tag[@name='HOST_START']/text()","report_host_start",
       "/ReportHost/HostProperties/tag[@name='HOST_END']/text()","report_host_end"         
 ]

Resulting in string field like "Fri Feb 17 00:22:07 2017".

I'm trying to parse with date plugin.

date {
           match => [ "report_host_start", "EEE MMM dd HH:mm:ss yyyy" ]
           target => "report_host_start"
           locale => "en_US"
}

without success...

i'm deleting index data before every test..

can anyone help me? tnks

[GrahamHannington]

Yes, I can help.

Solution

Insert the following mutate filter between your xml filter and your date filter:

mutate {
  replace => { "report_host_start" => "%{report_host_start[0]}" }
}

Example JSON output:

"report_host_start":"2017-02-17T00:22:07.000Z"

Explanation

The xpath setting of the xml filter returns an array:

["Fri Feb 17 00:22:07 2017"]

which the date filter does not match.

The mutate filter replaces the array with the value of its first element:

"Fri Feb 17 00:22:07 2017"

which the date filter does match.

Further reading

See the GitHub issue “Handling xpath results”.

Unsolicited advice

To match your situation as closely as possible, I used the XPath expression you cited to create the following sample XML input file:

<ReportHost>
  <HostProperties>
    <tag name="HOST_START">Fri Feb 17 00:22:07 2017</tag>
    <tag name="HOST_END"><!-- Some end date --></tag>
  </HostProperties>
</ReportHost>

Just a thought (not having a go): it occurs to me that other users who know far more about Logstash than me, but perhaps might not be as fluent in XPath, might have offered you an answer if you had provided such a sample.

Off-topic: have you considered specifying a timezone setting in your date filter?

[daian.martinho]

Thank you very much! Great answer.
It worked and i understood the problem.

[GrahamHannington]

You’re welcome. I’ve recently received some extremely useful help via these forums, so I was looking for an opportunity to contribute. Glad I could help.