# Another timestamp parse question

**URL:** <https://discuss.elastic.co/t/another-timestamp-parse-question/56468>\
**Category:** Logstash\
**Created:** [July 27, 2016, 4:33am UTC](https://discuss.elastic.co/t/another-timestamp-parse-question/56468 "2016-07-27T04:33:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![whoman](https://avatars.discourse-cdn.com/v4/letter/w/34f0e0/32.png) [@whoman](https://discuss.elastic.co/u/whoman)\
**Post date:** [July 27, 2016, 4:33am UTC](https://discuss.elastic.co/t/another-timestamp-parse-question/56468/1 "2016-07-27T04:33:46Z")

</div>

I'm trying to parse a log with lines like this:

[03:03:2016:20:18:56.131400] 0.1 ServerName HostName !ERROR [24667-4107126528] DNS resolution error ...

I want to parse the first field into a Kibana timestamp but have not been able to.

I've tried various filters, including one like this:

```
filter {

  grok {
    match => { "message" => "\[%{GREEDYDATA:my_timestamp}\]" }
  }

  date {
    match => ["my_timestamp", "MM:dd:yyyy:HH:mm:ss.SSSSSS"]
  }
}

```

But logstash throws errors like this:

```
Failed parsing date from field {:field=>"my_timestamp", :value=>"03:03:2016:20:18:56.131400] ServerName HostName !ERROR [24667-4107126528] DNS resolution error ... SkyController whoman-vm1 !...\" is malformed at \"] 0.1 SkyController whoman-vm1 !...\"", :config_parsers=>"MM:dd:yyyy:HH:mm:ss.SSSSSS", :config_locale=>"default=en_US", :level=>:warn}
{
         "message" => "[03:03:2016:20:18:56.131400] ServerName HostName !ERROR [24667-4107126528] DNS resolution error ...",
        "@version" => "1",
      "@timestamp" => "2016-07-27T04:18:27.654Z",
            "path" => "/data/logstash/input/tmp.log",
            "host" => "0.0.0.0",
    "my_timestamp" => "03:03:2016:20:18:56.131400] ServerName HostName !ERROR [24667-4107126528] DNS resolution error ...",
            "tags" => [
        [0] "_dateparsefailure"
    ]
}

```

Any ideas?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 27, 2016, 1:22pm UTC](https://discuss.elastic.co/t/another-timestamp-parse-question/56468/2 "2016-07-27T13:22:27Z")

</div>

Don't use GREEDYDATA here. As its name implies it's greedy and will match as much as it can. At the very least use the non-greedy DATA, but `(?<my_timestamp>[^\]]+)` is better (meaning: match everything up to the next `]`).

---

<div class="post-metadata">

**Author:** ![whoman](https://avatars.discourse-cdn.com/v4/letter/w/34f0e0/32.png) [@whoman](https://discuss.elastic.co/u/whoman)\
**Post date:** [August 2, 2016, 7:53am UTC](https://discuss.elastic.co/t/another-timestamp-parse-question/56468/3 "2016-08-02T07:53:19Z")

</div>

Thanks - that helped. Eventually got date parser working with this:

```
filter {

  grok {
    match => { "message" => "(?<my_timestamp>[^\s]+)" }
  }

  date {
    match => ["my_timestamp", "[MM:dd:yyyy:HH:mm:ss.SSSSSS]" ]
    target => "@timestamp"
    timezone => "America/Los_Angeles"
  }
}

```

Since log file has no timezone needed to express one here to get the conversion to UTC right.

Now, on to the next fields!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:45am UTC](https://discuss.elastic.co/t/another-timestamp-parse-question/56468/4 "2017-07-06T04:45:27Z")

</div>