# Add caracter in logstash custom patterns

**URL:** <https://discuss.elastic.co/t/add-caracter-in-logstash-custom-patterns/286158>\
**Category:** Logstash\
**Created:** [October 7, 2021, 8:04pm UTC](https://discuss.elastic.co/t/add-caracter-in-logstash-custom-patterns/286158 "2021-10-07T20:04:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adixon\_Diaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adixon_diaz/32/91182_2.png) [@Adixon\_Diaz](https://discuss.elastic.co/u/Adixon_Diaz)\
**Post date:** [October 7, 2021, 8:04pm UTC](https://discuss.elastic.co/t/add-caracter-in-logstash-custom-patterns/286158/1 "2021-10-07T20:04:14Z")

</div>

Hi comunity,

I want to add a caracter when i'm processing data with logstash, for example, add a space or : or -.

I mean, i have the next log

```auto
2021-07-29122715960
grok custom pattern: FECHACORTA ((?>\d\d){1,2}[./-]%{MONTHNUM}[/-]%{MONTHDAY})(?!<[0-9])%{HOUR:hora}%{MINUTE:minuto}(?:%{SECOND:segundos}):?%{INT:ms}

```

My idea, is to be able to convert from this 2021-07-29122715960 to 2021-07-29 12:27:15:960.

This happen because my log give to me that bad format.

Thanks

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 7, 2021, 8:14pm UTC](https://discuss.elastic.co/t/add-caracter-in-logstash-custom-patterns/286158/2 "2021-10-07T20:14:00Z")

</div>

If the end goal is to put into Elastic as a date then you can just use the [Date Filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html). This will convert it to UTC or Zulu timezone.

**Test Conf**

```auto
input { generator { lines => ['{ "old_timestamp": "2021-07-29122715960" }'] count => 1 codec => "json" } }
filter {
 date {
  match => ["old_timestamp", "yyyy-MM-ddHHmmssSSS"]
  target => "new_timestamp"
 }
}    
output { stdout { codec => json_lines } }

```

**Output**

```auto
{
    "new_timestamp": "2021-07-29T16:27:15.960Z",
    "old_timestamp": "2021-07-29122715960"
}

```

---

<div class="post-metadata">

**Author:** ![Adixon\_Diaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adixon_diaz/32/91182_2.png) [@Adixon\_Diaz](https://discuss.elastic.co/u/Adixon_Diaz)\
**Post date:** [October 7, 2021, 8:45pm UTC](https://discuss.elastic.co/t/add-caracter-in-logstash-custom-patterns/286158/3 "2021-10-07T20:45:25Z")

</div>

> [@aaron-nimocks](#):
>
> ```auto
> date {
> match => ["old_timestamp", "yyyy-MM-ddHHmmssSSS"]
> target => "new_timestamp"
> }
> 
> ```

You totally right, works perfect.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2021, 8:46pm UTC](https://discuss.elastic.co/t/add-caracter-in-logstash-custom-patterns/286158/4 "2021-11-04T20:46:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.