how can i extract date only from date field?

[avneet26]

hi , the format of the field is "errorOccuredOn":"2020-12-04+01:00" and i want to extract only the date i.e. only 2020-12-04 should be coming into the result. Let me know how this can be achieved.

[avneet26]

thanks it worked!

[gcusello]

Hi @avneet26,

if you already have the field  errorOccuredOn and you need only to extract the date, you can use this regex:

| rex  field=errorOccuredOn "^(?<errorOccuredOn>\d+-\d+-\d+)"

If instead you have to extract the field from the raw data, you can use the following regex

| rex "\"errorOccuredOn\":\"(?<errorOccuredOn>\d+-\d+-\d+)"

that you can test at https://regex101.com/r/CRiDtQ/1

Sorry, but did you open a new question instead continue the old one?

Ciao.

Giuseppe

[493669]

@avneet26 you can use substr command-

|eval errorOccuredOn=substr(errorOccuredOn,1,10)