# Converting MMM to MM in Logstash 2

**URL:** https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash-2/145640
**Category:** Logstash
**Created:** [August 23, 2018, 3:56am UTC](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash-2/145640 "2018-08-23T03:56:43Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Lydia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lydia/32/34731_2.png) [@Lydia](https://discuss.elastic.co/u/Lydia)
#### Post date: [August 23, 2018, 3:56am UTC](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash-2/145640/1 "2018-08-23T03:56:43Z")

</div>

I have the same problem with this person, and i am trying to make the output of my log\_date as the following format but i don't have a clue how to do it.  
log original input : [23/AUG/2018:00:00:00 +0800]  
and the output i want : 2018-08-23

> [@Converting MMM to MM in Logstash](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash/58570):
>
> I have typical Apache logs as follows 10.240.135.132 - - [22/Aug/2016:10:46:10 +0000] "GET /v1/cc\_services/neutron\_controller HTTP/1.1" 200 729 "-" "python-requests/2.9.1" As the month is in MMM format, I would like to convert it to MonthNumber such as for Aug it should be 08. I know "if else" can do it, but I wanted to know if there is anything simpler way to this?

what i have tried is use gsub function to change all the month from month name to month number, but this method doesn't work for me.  
then i have tried to add date{} in filter to match the date format, but it can only give the output like the original input ( output : 23/AUG/2018:00:00:00 +0800)

here is the code that i have got at the moment, i have tried both of them separated (both in the grok, message = 1 or 2 )

1. [%{MONTHDAY:day}/%{MONTH:month}/%{YEAR:year}:%{HOUR}:%{MINUTE}:%{SECOND} %{ISO8601\_TIMEZONE}] "

2.[(?([^+))]

1. mutate {  
add\_field =\> { "date" =\> "%{year}-%{month}-%{day}" }  
}

for 3 i have also tried to put the correct format of the date in match  
match =\> ["date" , "dd/MMM/yyyy:HH:mm:ss Z"]  
it does work but i couldn't get into the format of 2018-08-23

please help, and thank you for your time 🙂

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 27, 2018, 8:10pm UTC](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash-2/145640/2 "2018-08-27T20:10:28Z")

</div>

You're on the right track. Please post your configuration as preformatted text so we can see exactly what it looks like. Please also post an example raw message produced by Logstash, preferably as produced by a `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

### Author: ![Lydia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lydia/32/34731_2.png) [@Lydia](https://discuss.elastic.co/u/Lydia)
#### Post date: [August 28, 2018, 7:18am UTC](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash-2/145640/3 "2018-08-28T07:18:33Z")

</div>

thank you so much for answering this question 🙇‍♂️  
I had found the solution on the internet which the person create its own filter and here is the link  
[https://my.oschina.net/u/2457218/blog/753799](https://my.oschina.net/u/2457218/blog/753799)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 25, 2018, 7:18am UTC](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash-2/145640/4 "2018-09-25T07:18:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
