# Convert to timestamp
**URL:** https://discuss.elastic.co/t/convert-to-timestamp/131707
**Category:** Logstash
**Created:** [May 14, 2018, 9:36am UTC](https://discuss.elastic.co/t/convert-to-timestamp/131707 "2018-05-14T09:36:04Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Pinno\_Lin](https://discuss.elastic.co/u/Pinno_Lin)
#### Post date: [May 14, 2018, 9:36am UTC](https://discuss.elastic.co/t/convert-to-timestamp/131707/1 "2018-05-14T09:36:05Z")
Hi,
I have time record in syslog and want to convert to timestamp
Agent\_Local\_Time="2018/5/14 上午 09:58:59"
Agent\_Local\_Time="2018/5/11 下午 09:52:20"
It's 12-hour system. The "上午" is A.M and "下午" is P.M
How to get correct time to @timestamp?
thanks.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 14, 2018, 10:17am UTC](https://discuss.elastic.co/t/convert-to-timestamp/131707/2 "2018-05-14T10:17:56Z")
The date filter only recognizes AM and PM so you'll have to replace "上午" with AM and "下午" with PM. Use a mutate filter's gsub option.
---
### Author:  [@Pinno\_Lin](https://discuss.elastic.co/u/Pinno_Lin)
#### Post date: [May 15, 2018, 2:23am UTC](https://discuss.elastic.co/t/convert-to-timestamp/131707/3 "2018-05-15T02:23:18Z")
Hi, magnusbaeck,
Thank for your reply. I test gsub option in test file. but it show the error. Logstash can't parse Chinese word?
input {
file {
path =\> "/u1/mailSyslog/Sample1"
start\_position =\> "beginning"
sincedb\_path =\> "/dev/null"
tags =\> ["LAB"]
codec =\> plain {
charset =\> "UTF-8"
}
}
}
filter {
if "LAB" in [tags] {
mutate {
gsub =\> ["[dg][Agent\_Local\_Time]", "[上午]", "AM" ]
}
}
output {
if "LAB" in [tags] {
file {
path =\> "/tmp/lab.txt"
codec =\> rubydebug
}
}
}
[2018-05-15T09:47:04,023][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Createˆ]", "AM"\t]\n }\t\n}\n\noutput {\n\tif ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:in `block in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in`with\_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:in `converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in`block in converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in`converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in`block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 15, 2018, 6:37am UTC](https://discuss.elastic.co/t/convert-to-timestamp/131707/4 "2018-05-15T06:37:20Z")
Yeah, that might be the problem. Are you sure you've saved the configuration file as UTF-8?
---
### Author:  [@Pinno\_Lin](https://discuss.elastic.co/u/Pinno_Lin)
#### Post date: [May 15, 2018, 8:11am UTC](https://discuss.elastic.co/t/convert-to-timestamp/131707/5 "2018-05-15T08:11:12Z")
Hi magnusbaeck,
I had use other ways to get result i want. but it's not smart.
Thank for your reply. it's give some idea to resolve.
grok {
match =\> {
"Agent\_Local\_Time" =\> "%{GREEDYDATA:AgentDate} %{GREEDYDATA:AgentDatedep} %{GREEDYDATA:AgentTime}"
}
}
if "上午" in [AgentDatedep] {
mutate {
add\_field =\> { "EventTime" =\> "%{AgentDate} %{AgentTime} AM" }
}
}
if "下午" in [AgentDatedep] {
mutate {
add\_field =\> { "EventTime" =\> "%{AgentDate} %{AgentTime} PM" }
}
}
```
date {
match => ["EventTime", "yyyy/MM/dd hh:mm:ss a"]
timezone => "Asia/Taipei"
target => ["EventTime"]
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 12, 2018, 8:11am UTC](https://discuss.elastic.co/t/convert-to-timestamp/131707/6 "2018-06-12T08:11:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.