# Converting ISO8601 to date

**URL:** <https://discuss.elastic.co/t/converting-iso8601-to-date/133165>\
**Category:** Logstash\
**Created:** [May 24, 2018, 2:02pm UTC](https://discuss.elastic.co/t/converting-iso8601-to-date/133165 "2018-05-24T14:02:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Boukhdhira](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Boukhdhira](https://discuss.elastic.co/u/Boukhdhira)\
**Post date:** [May 24, 2018, 2:02pm UTC](https://discuss.elastic.co/t/converting-iso8601-to-date/133165/1 "2018-05-24T14:02:09Z")

</div>

Hi, i have a date converting problem. I have logs in this format:  
` 2018-04-12T18:20:13+02:00`  
And I parse logs timestamp by grok as TIMESTAMP\_ISO8601. And it works perfectly: log parses and fields adds. But i'm tring to extract date using 2 ways but it doesn't work.  
i used the following config:

> ```
> ruby {
> code => event['[@metadata][date]'] = event['timestamp_log'].strftime('%Y.%m.%d')
> }
> 
> ```

aloso i tried with :

> date {  
> match =\> ["timestamp\_log", "ddMMYYYY"]  
> }

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 24, 2018, 8:33pm UTC](https://discuss.elastic.co/t/converting-iso8601-to-date/133165/2 "2018-05-24T20:33:13Z")

</div>

If you use a date filter on the field containing "2018-04-12T18:20:13+02:00" and use the `target` option to not overwrite the `@timestamp` field you'll end up with a field containing a timestamp value where strftime will work. Extracting a string with grok will just produce a string.

---

<div class="post-metadata">

**Author:** ![Boukhdhira](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Boukhdhira](https://discuss.elastic.co/u/Boukhdhira)\
**Post date:** [May 25, 2018, 8:47am UTC](https://discuss.elastic.co/t/converting-iso8601-to-date/133165/3 "2018-05-25T08:47:37Z")

</div>

thanks for answering, i solve probleme using a ruby filter.

```
 ruby {
    		code => "
    		      date= event.get('timestamp_log');
   			      date= DateTime.strptime(date).to_time.localtime.strftime ('%Y%m%d');
  			     event.set('[@metadata][date]',date);
         			"
           	}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2018, 8:47am UTC](https://discuss.elastic.co/t/converting-iso8601-to-date/133165/4 "2018-06-22T08:47:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.