Logstash date format
up vote
0
down vote
favorite
I am using logstash to parse json input message and then add another field from one of the parsed values:
filter {
json {
source => "message"
target => "data"
}
mutate {
add_field => {
"index_date" => "%{[data][@timestamp]}}"
}
}
}
This works fine, but now I need index_date to be only the date.
How can I format the [data][@timestamp] field to only return the date?
logstash
edited Nov 5 at 21:02
Joel
1,4765719
asked Nov 5 at 19:38
javapenguin
361823
add a comment |
up vote
0
down vote
favorite
I am using logstash to parse json input message and then add another field from one of the parsed values:
filter {
json {
source => "message"
target => "data"
}
mutate {
add_field => {
"index_date" => "%{[data][@timestamp]}}"
}
}
}
This works fine, but now I need index_date to be only the date.
How can I format the [data][@timestamp] field to only return the date?
logstash
edited Nov 5 at 21:02
Joel
1,4765719
asked Nov 5 at 19:38
javapenguin
361823
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I am using logstash to parse json input message and then add another field from one of the parsed values:
filter {
json {
source => "message"
target => "data"
}
mutate {
add_field => {
"index_date" => "%{[data][@timestamp]}}"
}
}
}
This works fine, but now I need index_date to be only the date.
How can I format the [data][@timestamp] field to only return the date?
logstash
edited Nov 5 at 21:02
Joel
1,4765719
asked Nov 5 at 19:38
javapenguin
361823
I am using logstash to parse json input message and then add another field from one of the parsed values:
filter {
json {
source => "message"
target => "data"
}
mutate {
add_field => {
"index_date" => "%{[data][@timestamp]}}"
}
}
}
This works fine, but now I need index_date to be only the date.
How can I format the [data][@timestamp] field to only return the date?
logstash
logstash
edited Nov 5 at 21:02
Joel
1,4765719
asked Nov 5 at 19:38
javapenguin
361823
edited Nov 5 at 21:02
Joel
1,4765719
asked Nov 5 at 19:38
javapenguin
361823
edited Nov 5 at 21:02
Joel
1,4765719
edited Nov 5 at 21:02
Joel
1,4765719
edited Nov 5 at 21:02
Joel
1,4765719
1,4765719
asked Nov 5 at 19:38
javapenguin
361823
asked Nov 5 at 19:38
javapenguin
361823
asked Nov 5 at 19:38
javapenguin
361823
361823
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
accepted
You will need to install the date_formatter plugin with
bin/logstash-plugin install logstash-filter-date
And then you can use something like this in your logstash filter function
date_formatter {
source => "index_data"
target => "[@metadata][indexDateOnlyDate]"
pattern => "YYYY.MM.dd"}
This should work :)
answered Nov 6 at 16:28
Robin Medland
214
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
accepted
You will need to install the date_formatter plugin with
bin/logstash-plugin install logstash-filter-date
And then you can use something like this in your logstash filter function
date_formatter {
source => "index_data"
target => "[@metadata][indexDateOnlyDate]"
pattern => "YYYY.MM.dd"}
This should work :)
answered Nov 6 at 16:28
Robin Medland
214
add a comment |
up vote
0
down vote
accepted
You will need to install the date_formatter plugin with
bin/logstash-plugin install logstash-filter-date
And then you can use something like this in your logstash filter function
date_formatter {
source => "index_data"
target => "[@metadata][indexDateOnlyDate]"
pattern => "YYYY.MM.dd"}
This should work :)
answered Nov 6 at 16:28
Robin Medland
214
add a comment |
up vote
0
down vote
accepted
up vote
0
down vote
accepted
You will need to install the date_formatter plugin with
bin/logstash-plugin install logstash-filter-date
And then you can use something like this in your logstash filter function
date_formatter {
source => "index_data"
target => "[@metadata][indexDateOnlyDate]"
pattern => "YYYY.MM.dd"}
This should work :)
answered Nov 6 at 16:28
Robin Medland
214
You will need to install the date_formatter plugin with
bin/logstash-plugin install logstash-filter-date
And then you can use something like this in your logstash filter function
date_formatter {
source => "index_data"
target => "[@metadata][indexDateOnlyDate]"
pattern => "YYYY.MM.dd"}
This should work :)
answered Nov 6 at 16:28
Robin Medland
214
answered Nov 6 at 16:28
Robin Medland
214
answered Nov 6 at 16:28
Robin Medland
214
answered Nov 6 at 16:28
Robin Medland
214
214
add a comment |
add a comment |
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53161093%2flogstash-date-format%23new-answer', 'question_page');
}
);
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
