CODEWITHSUNDEEP
logstash
javapenguin
javapenguin

Reputation: 1036

Logstash date format

I am using logstash to parse json input message and then add another field from one of the parsed values:

filter {
  json {
    source => "message"
    target => "data"
  }
  mutate {
    add_field => {
        "index_date" => "%{[data][@timestamp]}}"
    }
  }
}

This works fine, but now I need index_date to be only the date. How can I format the [data][@timestamp] field to only return the date?

Upvotes: 2

Views: 2102

Answers (1)

Robin Medland
Robin Medland

Reputation: 146

You will need to install the date_formatter plugin with

bin/logstash-plugin install logstash-filter-date

And then you can use something like this in your logstash filter function

date_formatter {
    source => "index_data"
    target => "[@metadata][indexDateOnlyDate]"
    pattern => "YYYY.MM.dd"}

This should work :)

Upvotes: 4

Related Questions