# Converting date to YYYY-MM-DD from YYYY/MM/DD HH:MM:SS

**URL:** <https://discuss.elastic.co/t/converting-date-to-yyyy-mm-dd-from-yyyy-mm-dd-hh-mm-ss/31689>\
**Category:** Logstash\
**Created:** [October 6, 2015, 12:09pm UTC](https://discuss.elastic.co/t/converting-date-to-yyyy-mm-dd-from-yyyy-mm-dd-hh-mm-ss/31689 "2015-10-06T12:09:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Deb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deb/32/46162_2.png) [@Deb](https://discuss.elastic.co/u/Deb)\
**Post date:** [October 6, 2015, 12:09pm UTC](https://discuss.elastic.co/t/converting-date-to-yyyy-mm-dd-from-yyyy-mm-dd-hh-mm-ss/31689/1 "2015-10-06T12:09:20Z")

</div>

Hi,

I am having nginx error logs of the form:-

> 2015/09/30 22:19:38 [error] 32317#0: \*23 [lua] responses.lua:61: handler(): Cassandra error: Error during UNIQUE check: Cassandra error: connection refused, client: 127.0.0.1, server: , request: "POST /consumers/ HTTP/1.1", host: "localhost:8001"

As mentioned [here](https://logstash.jira.com/browse/LOGSTASH-1663?focusedCommentId=20224&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-20224) I am able to parse this logs.

Can some one let me know how can I create a field containing the log timestamp in the format YYYY-MM-DD. So as per the above example I want to have field `log_day` having value `2015-09-30`?

The filters that I am using is shown below:-

```
filter {  
  grok {
      match => {
        "message" => [
          "%{DATESTAMP:mydate} \[%{DATA:severity}\] (%{NUMBER:pid:int}#%{NUMBER}: \*%{NUMBER}|\*%{NUMBER}) %{GREEDYDATA:mymessage}",
          "%{DATESTAMP:mydate} \[%{DATA:severity}\] %{GREEDYDATA:mymessage}",
          "%{DATESTAMP:mydate} %{GREEDYDATA:mymessage}"
        ]
      }
      add_tag => ["nginx_error_pattern"]
    }

    if ("nginx_error_pattern" in [tags]) {      
      grok {
        match => {
          "mymessage" => [
            "server: %{DATA:[request_server]},"
          ]
        }        
      }

      grok {
        match => {
          "mymessage" => [
            "host: \"%{IPORHOST:[request_host]}:%{NUMBER:[port]}\""
          ]
        }        
      }

      grok {
        match => {
          "mymessage" => [
            "request: \"%{WORD:[request_method]} %{DATA:[request_uri]} HTTP/%{NUMBER:[request_version]:float}\""
          ]
        }        
      }

      grok {
        match => {
          "mymessage" => [
            "client: %{IPORHOST:[clientip]}",
            "client %{IP:[clientip]} "
          ]
        }        
      }

      grok {
        match => {
          "mymessage" => [
            "referrer: \"%{DATA:[request_referrer]}\""
          ]
        }       
      }      

      grok {
        match => [
          "mydate", "^(?<app_log_time>%{DATE_EU})"
        ]
      }      
    }
}

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 6, 2015, 12:32pm UTC](https://discuss.elastic.co/t/converting-date-to-yyyy-mm-dd-from-yyyy-mm-dd-hh-mm-ss/31689/2 "2015-10-06T12:32:38Z")

</div>

What's the purpose of the `log_day` field? Just making sure we're attempting to solve the right problem.

Side notes:

- I suspect `server: %{DATA:[request_server]},` is matching more than you'd like it too.

- Merging the current grok expressions into a single expression should improve performance.

- You may want to consider using the [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) for parsing this data.

---

<div class="post-metadata">

**Author:** ![wiibaa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wiibaa/32/44931_2.png) [@wiibaa](https://discuss.elastic.co/u/wiibaa)\
**Post date:** [October 8, 2015, 10:39am UTC](https://discuss.elastic.co/t/converting-date-to-yyyy-mm-dd-from-yyyy-mm-dd-hh-mm-ss/31689/3 "2015-10-08T10:39:08Z")

</div>

If you do not plan to use the date filter to replace `@timestamp` with the value of `mydate` and then use the syntax `%{+yyyy-MM-dd}` then you might want to try out this filter that is pending review for integration in logstash-plugins but already published to rubygems [https://rubygems.org/gems/logstash-filter-date\_formatter](https://rubygems.org/gems/logstash-filter-date_formatter)

You have first to parse your date string into a date field , then use this date field in the date\_formatter

```
filter {
  date {
    match => ["mydate", "YYYY/MM/dd HH:mm:ss"]
    target => "my_date_as_date"
  }
  date_formatter {
    source => "my_date_as_date"
    target => "log_day"
    pattern => "yyyy-MM-dd"
  }
}
```

---

<div class="post-metadata">

**Author:** ![Deb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deb/32/46162_2.png) [@Deb](https://discuss.elastic.co/u/Deb)\
**Post date:** [October 24, 2015, 7:16am UTC](https://discuss.elastic.co/t/converting-date-to-yyyy-mm-dd-from-yyyy-mm-dd-hh-mm-ss/31689/4 "2015-10-24T07:16:22Z")

</div>

Thanks @wiibaa

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:25am UTC](https://discuss.elastic.co/t/converting-date-to-yyyy-mm-dd-from-yyyy-mm-dd-hh-mm-ss/31689/5 "2017-07-06T05:25:32Z")

</div>