Unable to change date format

Elastic Stack Logstash
1

Hello everyone,

I've seen several topics with the same problem, however none of the solutions I found worked for me and it's making me crazy because I am sure it should be very simple.

To explain the problem, I am using a ruby filter to extract data from a long line based on where the information is on the line and one of these data is a datetime.
For example :

event.set('[heading][date]', event.get('[message]')[1526..1544])

Hewever, this makes the following output with this format:

"heading": {
"date": "2022-02-01-00.00.00"
}

I want it to be in this format : "date": "2022-02-01T00:00:00.000Z" (the same as @timestamp)
I tried to use date filter or strftime in ruby but I can't make it work.

Thanks for your help and sorry if I should have find in other topics

2

This topic must be about Logstash.

ruby filter and date filter worked fine for me.


input {
  generator {
      lines => [
          "2022-02-01-00.00.00",
          "2022-02-01-00.00.00Z"
      ]
      count => 1
  }
}
filter{
    ruby {
        code => "
            event.set('[datestr]', event.get('[message]')[0..18])
        "
    }
    date {
        match => ["datestr", "yyyy-MM-dd-HH.mm.ss"]
        target => "datetime"
        timezone => "Asia/Tokyo"
    }
}
output {
    stdout {
        codec => rubydebug{metadata => false}
    }
}
3

Sorry for the mistake I juste changed it.

Thanks for your reply I will try this and keep you updated !

4

Thanks @Tomo_M it works fine ! I guess it was just a mistake in the date format in my filter :frowning:

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.