how to have a particular day of a date field in logstash?

问题

I have a date field which has a config of 2019-07-26T16:04:56.853Z this kind in my data when i have given add field with +EEEE, it is giving the day of timestamp , but not the required output.

add_field => {"[weekday]" => "%{+EEEEE}"}

I need that the output of the date field of 2019-07-26T16:04:56.853Zgives friday but it is giving the timestamp day.

回答1:

Assuming you have the string "2019-07-26T16:04:56.853Z" in a field called [date] then this will set [dayOfWeek] to Friday

    mutate { gsub => [ "Date", "Z$", "" ] }
    date { match => [ "date", ISO8601 ] target => "[@metadata][date]" }
    ruby { code => '
        t = Time.at(event.get("[@metadata][date]").to_i)
        d = DateTime.parse(t.to_s)
        event.set("dayOfWeek", d.strftime("%A"))
    ' }

来源：https://stackoverflow.com/questions/57391048/how-to-have-a-particular-day-of-a-date-field-in-logstash