Timestamp format

[max1991]

Hello community,

I have a question regarding timestamp format. Currently I have following format: 2022-12-08T22:48:32.336. Is there any simple way to change it to DATE ONLY? For example 2022-12-08.

Thank you in advance!

[gsmith]

Hello && Welcome @max1991

Short answer is Yes.

You can accomplish this a couple different ways but the preferred way would probably be a Pipeline.
Maybe something like this.

rule "Date"
when
    has_field("message")
then    
	let new_date = parse_date(to_string($message.timestamp),"yyyy MMM dd ","Chicago/Amercia");
	set_field("timestamp", new_date);
end

Or perhaps a Regular expression extractor.
Example: