# Can't find correct Joda Time Documentation

**URL:** <https://discuss.elastic.co/t/cant-find-correct-joda-time-documentation/103062>\
**Category:** Logstash\
**Created:** [October 6, 2017, 7:02pm UTC](https://discuss.elastic.co/t/cant-find-correct-joda-time-documentation/103062 "2017-10-06T19:02:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dolanmk](https://avatars.discourse-cdn.com/v4/letter/d/a183cd/32.png) [@dolanmk](https://discuss.elastic.co/u/dolanmk)\
**Post date:** [October 6, 2017, 7:02pm UTC](https://discuss.elastic.co/t/cant-find-correct-joda-time-documentation/103062/1 "2017-10-06T19:02:54Z")

</div>

Hi,

I am using Logstash to parse some install logs. I have a field named LOG\_DATE and the grok pattern is correct but I need to change the field from a string to a date. I am using the date filter plugin to do this. I have used this correctly before but I cannot seem to get the Joda abbreviations correct.

Here is what the LOG\_DATE field looks like:

```
Mon Sep 11 13:49:24 EDT 2017

```

Here is what I am currently trying in the date filter:

```
    date {
      match => ["log_date", "EEE MMM dd HH:mm:ss ZZZ YYYY"]
      target => "logdate"
      locale => "en"
      remove_field => ["log_date"]
    }

```

I am still getting a date parse error and the field LOGDATE (no underscore) is not being created.

Thank you for your help!

Miranda

---

<div class="post-metadata">

**Author:** ![dolanmk](https://avatars.discourse-cdn.com/v4/letter/d/a183cd/32.png) [@dolanmk](https://discuss.elastic.co/u/dolanmk)\
**Post date:** [October 9, 2017, 3:21pm UTC](https://discuss.elastic.co/t/cant-find-correct-joda-time-documentation/103062/2 "2017-10-09T15:21:44Z")

</div>

I have found my own solution. The time zone that is being added to my target log files is not on the list of known abbreviations for Joda-time.

For anyone else who may have a similar issue, the list of known time zones for Joda-time can be found here:  
[http://joda-time.sourceforge.net/timezones.html](http://joda-time.sourceforge.net/timezones.html)

To be able to use this special time zone I have added a date pattern that has the abbreviation statically defined if Joda does not detect the given time zone.

```
   date {
      match => ["log_date", "EEE MMM dd HH:mm:ss ZZZ YYYY", "EEE MMM dd HH:mm:ss 'EDT' YYYY"]
      target => "logdate"
      locale => "en"
      remove_field => ["log_date"]
   }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2017, 3:22pm UTC](https://discuss.elastic.co/t/cant-find-correct-joda-time-documentation/103062/3 "2017-11-06T15:22:05Z")

</div>

Closed on November 6, 2017, 3:22pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.