# Conversion of timeformat

**URL:** <https://discuss.elastic.co/t/conversion-of-timeformat/270961>\
**Category:** Logstash\
**Created:** [April 22, 2021, 1:01pm UTC](https://discuss.elastic.co/t/conversion-of-timeformat/270961 "2021-04-22T13:01:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mansa](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@mansa](https://discuss.elastic.co/u/mansa)\
**Post date:** [April 22, 2021, 1:01pm UTC](https://discuss.elastic.co/t/conversion-of-timeformat/270961/1 "2021-04-22T13:01:47Z")

</div>

Hi Folks we have few logs which comes into time format "2021-04-05 08:04:24+07:00" and i want to convert this time into format "Sep 15 18:58:48" because i am sending logs to different SIEM which reads only syslog time stamp.  
Can any one help what is best way to convert the timestamp. I tried with Date filter but didn't help.

Pipeline is

filter {  
grok {  
match =\> ["message", "%{WORD:P1}\s+:\s+%{WORD:NEType}\s+%{WORD:P2}\s+:\s+%{WORD:NEName}\s+%{WORD:P3}\s+:\s+%{IPV4:IP}\s+%{WORD:P4}\s+:\s+%{DATA:Operator}\s+%{WORD:P5}\s+:\s+%{IPV4:TerminalIP}\s+%{WORD:P6}\s+:\s+%{TIMESTAMP\_ISO8601:Time}+07:00\s+%{GREEDYDATA:Data}"]  
}

date {  
match =\> ["Time" , "MMM dd HH:mm:ss"]  
target =\> "Time1"  
}

mutate {  
remove\_field =\> ["message"]  
}  
mutate {  
add\_field =\> {  
"message" =\> "%{Time1} %{IP} %{Data}"  
}  
remove\_field =\> ["Time", "IP", "Data"]  
}  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 22, 2021, 3:23pm UTC](https://discuss.elastic.co/t/conversion-of-timeformat/270961/2 "2021-04-22T15:23:37Z")

</div>

Use a date filter to parse the "2021-04-05 08:04:24+07:00" and then use a [ruby filter](https://discuss.elastic.co/t/date-field-being-converted-to-timestamps/180044/4) that calls strftime to format that timestamp in a different way.

---

<div class="post-metadata">

**Author:** ![mansa](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@mansa](https://discuss.elastic.co/u/mansa)\
**Post date:** [April 23, 2021, 11:56am UTC](https://discuss.elastic.co/t/conversion-of-timeformat/270961/3 "2021-04-23T11:56:55Z")

</div>

I tried above suggestion but didn't worked for me... I may be wrong on coding. Could you please help me with date & ruby filter format.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 23, 2021, 2:21pm UTC](https://discuss.elastic.co/t/conversion-of-timeformat/270961/4 "2021-04-23T14:21:27Z")

</div>

What did you try?

---

<div class="post-metadata">

**Author:** ![mansa](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@mansa](https://discuss.elastic.co/u/mansa)\
**Post date:** [April 29, 2021, 1:24pm UTC](https://discuss.elastic.co/t/conversion-of-timeformat/270961/5 "2021-04-29T13:24:18Z")

</div>

Hi i tried this but no help..can you please verify what causing issue  
filter {  
grok {  
match =\> ["message", "%{WORD:P1}\s+:\s+%{WORD:NEType}\s+%{WORD:P2}\s+:\s+%{WORD:NEName}\s+%{WORD:P3}\s+:\s+%{IPV4:IP}\s+%{WORD:P4}\s+:\s+%{DATA:Operator}\s+%{WORD:P5}\s+:\s+%{IPV4:TerminalIP}\s+%{WORD:P6}\s+:\s+%{TIMESTAMP\_ISO8601:Time}+07:00\s+%{GREEDYDATA:Data}"]  
}

date {  
match =\> ["TIME", "ISO8601"]  
target =\> "date\_object"  
}  
ruby {  
code =\> '  
t = Time.at(event.get("@date\_object").to\_f)  
event.set("Time1", t.strftime("%Y-%m-%d"))  
}  
mutate {  
remove\_field =\> ["message"]  
}  
mutate {  
add\_field =\> {  
"message" =\> "%{Time1} %{NEName} %{Data}"  
}  
remove\_field =\> ["Time1", "NEName", "Data"]  
}  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 29, 2021, 5:58pm UTC](https://discuss.elastic.co/t/conversion-of-timeformat/270961/6 "2021-04-29T17:58:53Z")

</div>

TIME and Time are different fields, as are date\_object and @date\_object. Joda does [not agree](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882/4) that that time format matches an ISO8601 pattern. Try

```
   date { match => ["Time", "yyyy-MM-dd HH:mm:ssZ"] target => "date_object" }
    ruby {
        code => '
            t = Time.at(event.get("date_object").to_f)
            event.set("Time1", t.strftime("%Y-%m-%d"))
        '
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2021, 5:59pm UTC](https://discuss.elastic.co/t/conversion-of-timeformat/270961/7 "2021-05-27T17:59:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.