# Convert sting to date time in logstash

**URL:** <https://discuss.elastic.co/t/convert-sting-to-date-time-in-logstash/62523>\
**Category:** Logstash\
**Created:** [October 7, 2016, 6:27pm UTC](https://discuss.elastic.co/t/convert-sting-to-date-time-in-logstash/62523 "2016-10-07T18:27:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\
**Post date:** [October 7, 2016, 6:27pm UTC](https://discuss.elastic.co/t/convert-sting-to-date-time-in-logstash/62523/1 "2016-10-07T18:27:11Z")

</div>

how can i convert the below string into date time

Wed Aug 03 11:48:58 2016

I am using the below pattern to put it in a column  
?[%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}])

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 8, 2016, 4:12am UTC](https://discuss.elastic.co/t/convert-sting-to-date-time-in-logstash/62523/2 "2016-10-08T04:12:04Z")

</div>

Have you seen the date filter? [https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html)

---

<div class="post-metadata">

**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\
**Post date:** [October 8, 2016, 4:16am UTC](https://discuss.elastic.co/t/convert-sting-to-date-time-in-logstash/62523/3 "2016-10-08T04:16:29Z")

</div>

date {  
locale =\> "en"  
match =\> ["timestamp", "YYYY-MM-dd HH:mm:ss", "YYYY-MM-dd HH:mm:ss.SSSS"]  
timezone =\> "Etc/UCT"

}

This is what i am trying to do but not working

---

<div class="post-metadata">

**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\
**Post date:** [October 8, 2016, 4:23am UTC](https://discuss.elastic.co/t/convert-sting-to-date-time-in-logstash/62523/4 "2016-10-08T04:23:38Z")

</div>

[Wed Aug 03 11:48:58 2016]

when i try to convert

date {  
locale =\> "en"  
match =\> ["timestamp", "D MM dd HH:mm:ss YYYY", "YYYY-MM-dd HH:mm:ss.SSSS"]

}

←[33mFailed parsing date from field {:field=\>"timestamp", :value=\>"[Wed Aug 10 1  
3:19:19 2016]", :exception=\>"Invalid format: "[Wed Aug 10 13:19:19 2016]"", :c  
onfig\_parsers=\>"D MM dd HH:mm:ss YYYY,YYYY-MM-dd HH:mm:ss.SSSS", :config\_locale=

> "en", :level=\>:warn}←[0m

---

<div class="post-metadata">

**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\
**Post date:** [October 8, 2016, 5:11am UTC](https://discuss.elastic.co/t/convert-sting-to-date-time-in-logstash/62523/5 "2016-10-08T05:11:52Z")

</div>

Solution

grok {  
match =\> { message =\> [  
"[%{DAY:d} %{MONTH:m} %{MONTHDAY:md} %{TIME:t} %{YEAR:y}] [%{NOTSPACE:logger}] [%{WORD:source} %{IP:ip}] (?%{WORD:text1} %{WORD:text1} %{WORD:text1} %{WORD:text1}): %{URIPATH:path}, %{WORD:referer}: %{GREEDYDATA:url}",  
"[%{DAY:d} %{MONTH:m} %{MONTHDAY:md} %{TIME:t} %{YEAR:y}] [%{NOTSPACE:logger}] [%{WORD:source} %{IP:ip}] (?%{WORD:text1} %{WORD:text1} %{WORD:text1} %{WORD:text1}): %{URIPATH:path}"  
]}  
add\_tag =\> ["error"]

}

mutate {  
add\_field =\> {  
"timestamp" =\> "%{md}-%{m}-%{y} %{t}"  
}   
}  
date {  
match =\> ["timestamp", "dd-MMM-yyyy HH:mm:ss", "YYYY-MM-dd HH:mm:ss"]  
target =\> "timestamp"  
locale =\> "en"  
}

Result

"timestamp" =\> "2016-08-03T06:18:58.000Z"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/convert-sting-to-date-time-in-logstash/62523/6 "2017-07-06T04:35:04Z")

</div>