# Can't match string to format date

**URL:** <https://discuss.elastic.co/t/cant-match-string-to-format-date/329132>\
**Category:** Logstash\
**Created:** [April 2, 2023, 6:35pm UTC](https://discuss.elastic.co/t/cant-match-string-to-format-date/329132 "2023-04-02T18:35:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![german](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/german/32/119303_2.png) [@german](https://discuss.elastic.co/u/german)\
**Post date:** [April 2, 2023, 6:35pm UTC](https://discuss.elastic.co/t/cant-match-string-to-format-date/329132/1 "2023-04-02T18:35:11Z")

</div>

Hi everybody,

I have a problem while I try to convert a string variable to timestamp.

I'm using date module without successful result. Format date is **dd/MM/yyyy hh:mm:ss.SSSSSS** and originally the variable newDate is:

```auto
          "logLevel" => "DEBUG4:",
    "strangeElement" => "elk1",
        "newMessage" => "DelayedCollectionPolicy.getNextFile()=null",
           "newDate" => "04/02/2023 00:53:00.006357"

```

And I tried to use match next way, but not workwed:

```auto
  date {
    match => ["newDate", "dd/MM/yyyy hh:mm:ss.SSSSSS"]
    timezone => "America/Mexico_City"
    target => "otherDate"
  }

```

For that reason it came to my mind to split newDate variable ahead of applying the match, in order to get rid of six miliseconds, as I thought that six milliseconds were causing some conflict but neither worked too, as the match doesn't success.

```auto
           "newDate" => [
        [0] "04/02/2023 06:50:00",
        [1] "007299"
    ],

```

```auto

  date {
    match => ["[newDate][0]", "dd/MM/yyyy hh:mm:ss" ]
    timezone => "America/Mexico_City"
    target => "otherDate"
  }

```

I tried to use different timezone, but neither works. Any suggestion?

Thanks.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 2, 2023, 6:46pm UTC](https://discuss.elastic.co/t/cant-match-string-to-format-date/329132/2 "2023-04-02T18:46:44Z")

</div>

> [@german](#):
>
> ```auto
> date {
> match => ["newDate", "dd/MM/yyyy hh:mm:ss.SSSSSS"]
> timezone => "America/Mexico_City"
> target => "otherDate"
> }
> 
> ```

You need to use `HH`, using `hh` only matches 12-hour clocks, so it only matchs `01-12`.

If your hour is showing `00` you have a 24-hour clock, so you need to use `HH` which will match `00-23`.

Also, is this `dd/MM/yyyy` or `MM/dd/yyyy`?

If it is `dd/MM/yyyy` then your log is for February 4th, is this correct?

```auto
"newDate" => "04/02/2023 00:53:00.006357"

```

---

<div class="post-metadata">

**Author:** ![german](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/german/32/119303_2.png) [@german](https://discuss.elastic.co/u/german)\
**Post date:** [April 2, 2023, 11:05pm UTC](https://discuss.elastic.co/t/cant-match-string-to-format-date/329132/3 "2023-04-02T23:05:58Z")

</div>

I didn't realized about "hh". When I used "HH" instead of "hh", it worked.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 3, 2023, 2:13am UTC](https://discuss.elastic.co/t/cant-match-string-to-format-date/329132/4 "2023-04-03T02:13:29Z")

</div>

There are four patterns for hours. HH is for 0-23, kk is for 1-24. I think these will ignore the value of an a pattern (AM/PM) so you also need KK for 0-11 and hh for 1-12.

---

<div class="post-metadata">

**Author:** ![german](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/german/32/119303_2.png) [@german](https://discuss.elastic.co/u/german)\
**Post date:** [April 3, 2023, 3:30am UTC](https://discuss.elastic.co/t/cant-match-string-to-format-date/329132/5 "2023-04-03T03:30:23Z")

</div>

Thanks for your answer Badger.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2023, 3:30am UTC](https://discuss.elastic.co/t/cant-match-string-to-format-date/329132/6 "2023-05-01T03:30:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.