Transform a field

Elastic Stack Logstash
1

Hello,

I have a field that is created from xml file with xpath formula :

"time": "2017-03-03T16:48:28.933+01:00" (<time>2017-03-03T16:48:28.933+01:00<'/time> in xml input).

I want to create a nested field like this :

"time": "2017-03-03 16:48:28"

where i am wrong please suggest

ruby {
			code => '
			b = event["step_start_date"].split("T")[0];
			for c in b ;
			f= c.split(".")[0];				
			end;
			event.set("step_start_date", "%{b} %{f}")
				'
		}

Thank you for help.

2

You don't need a ruby filter for this. The mutate filter's gsub option is enough. Replace the T with a space and replace the milliseconds and timezone with nothing.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.