# Add year to timestamp

**URL:** <https://discuss.elastic.co/t/add-year-to-timestamp/68195>\
**Category:** Logstash\
**Created:** [December 6, 2016, 4:32pm UTC](https://discuss.elastic.co/t/add-year-to-timestamp/68195 "2016-12-06T16:32:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssasporta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ssasporta/32/13695_2.png) [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Post date:** [December 6, 2016, 4:32pm UTC](https://discuss.elastic.co/t/add-year-to-timestamp/68195/1 "2016-12-06T16:32:31Z")

</div>

Hi,

The time stamp in my log looks like that: `[Mar 01 14:55:11]` . No year available.  
I want to add it to, to be the current year if possible or the previous year. I need to have the year, I assume int he timestamp, to be able to visualize according to the timestamp.

I mean, if we are on Dec 2016, and the Month was Jan, so it must be 2016 and can't be 2017. In general, if the date is later then current date, to use it with the previous year.  
That Year need to be calculated and inserted hardcoded, to be include in the timestamp.

How can I do that?

Regards,  
Sharon.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 6, 2016, 6:36pm UTC](https://discuss.elastic.co/t/add-year-to-timestamp/68195/2 "2016-12-06T18:36:12Z")

</div>

The date filter can handle that, just define the pattern yourself and it will add a the appropriate year.

---

<div class="post-metadata">

**Author:** ![ssasporta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ssasporta/32/13695_2.png) [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Post date:** [December 7, 2016, 12:36pm UTC](https://discuss.elastic.co/t/add-year-to-timestamp/68195/3 "2016-12-07T12:36:55Z")

</div>

Hi,

I tried it but it didn't work.

Thats from the log:

```
"@timestamp" => "2016-12-07T10:18:09.237Z",
   "message" => "<<DEBUG>> [Mar 01 14:55:23] [[ACTIVE] ExecuteThread: '9' for queue: 'weblogic.kernel.Default (self-tuning)'] [CM] [OMS] (BasicParameter.isResource) Exit",
  "@version" => "1",
      "type" => "cm_server_log",
     "count" => 1,

```

The error occurred on the 01-Mar but the timestamp is the time when the doc was created.

The piece of configuration from my logstash is that:

```
            multiline {
                       patterns_dir => "/users/mpswrk1/LogStash/impls/patterns/patterns"
                       pattern => "^\<\<%{LOGLEVEL}\>\> "
                       negate => true
                       what => "previous"
            }
            grok {
                    match => { "message" => "\<\<%{LOGLEVEL:severity}\>\> \[%{PARTTIMESTAMP:timestamp}\] \[\[%{DATA:status}\] %{DATA:execute_thread}\] \[%{WORD:source_app}\] \(%{JAVACLASS:method}\) %{DATA:exception_method_description}\: \(%{DATA:error_code}\) %{DATA:error_description}%{JAVASTACKTRACEPART:java_class_stack}" }
                    patterns_dir => "/users/mpswrk1/LogStash/impls/patterns/patterns"
            }
            date {
                     match => ["timestamp" , "MMM dd hh:mm:ss aa"]
            }
            if "_grokparsefailure" in [tags] {
                           drop { }
            }

```

I assume something is wrong in my configuration.

Regards,  
Sharon.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 7, 2016, 8:29pm UTC](https://discuss.elastic.co/t/add-year-to-timestamp/68195/4 "2016-12-07T20:29:29Z")

</div>

> [@ssasporta](#):
>
> %{PARTTIMESTAMP:timestamp}

That is that in your patterns file?

---

<div class="post-metadata">

**Author:** ![ssasporta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ssasporta/32/13695_2.png) [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Post date:** [December 7, 2016, 9:37pm UTC](https://discuss.elastic.co/t/add-year-to-timestamp/68195/5 "2016-12-07T21:37:57Z")

</div>

Hi,

Yes, this is from my pattern file:

`PARTTIMESTAMP %{MONTH} %{MONTHDAY} %{TIME}`

Thanks  
Sharon.

---

<div class="post-metadata">

**Author:** ![ssasporta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ssasporta/32/13695_2.png) [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Post date:** [December 8, 2016, 6:58pm UTC](https://discuss.elastic.co/t/add-year-to-timestamp/68195/6 "2016-12-08T18:58:20Z")

</div>

Can someone help here?

Regards,  
Sharon.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 5, 2017, 6:58pm UTC](https://discuss.elastic.co/t/add-year-to-timestamp/68195/7 "2017-01-05T18:58:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.