# Converting MMM to MM in Logstash

**URL:** https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash/58570
**Category:** Logstash
**Created:** [August 22, 2016, 11:21am UTC](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash/58570 "2016-08-22T11:21:34Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![vvs14](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vvs14/32/11328_2.png) [@vvs14](https://discuss.elastic.co/u/vvs14)
#### Post date: [August 22, 2016, 11:21am UTC](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash/58570/1 "2016-08-22T11:21:34Z")

</div>

I have typical Apache logs as follows

> 10.240.135.132 - - [22/Aug/2016:10:46:10 +0000] "GET /v1/cc\_services/neutron\_controller HTTP/1.1" 200 729 "-" "python-requests/2.9.1"

As the month is in MMM format, I would like to convert it to MonthNumber such as for Aug it should be 08. I know "if else" can do it, but I wanted to know if there is anything simpler way to this?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 22, 2016, 11:23am UTC](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash/58570/2 "2016-08-22T11:23:46Z")

</div>

You could use the mutate filter's gsub option, but why do you want to do this in the first place? The normal procedure would be to parse the timestamp with the date filter, and that plugin supports parsing month names.

---

<div class="post-metadata">

### Author: ![vvs14](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vvs14/32/11328_2.png) [@vvs14](https://discuss.elastic.co/u/vvs14)
#### Post date: [August 22, 2016, 11:30am UTC](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash/58570/3 "2016-08-22T11:30:26Z")

</div>

Actually I am trying to create a additional time stamp field, say X, which takes exact time of log and normalize all time stamps in all kinds of logs in format YYYY-MM-dd, HH:mm:ss, make this as "date" kind of field and sort logs based on it. Similar to ISO format. Kibana time is brower time, it can't be used for that purpose.  
When I am creating X with Aug and use format 2016-Aug-22, ES throws error saying it is not unable to parse this kind of date format.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 22, 2016, 12:08pm UTC](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash/58570/4 "2016-08-22T12:08:47Z")

</div>

> Actually I am trying to create a additional time stamp field, say X, which takes exact time of log and normalize all time stamps in all kinds of logs in format YYYY-MM-dd, HH:mm:ss, make this as "date" kind of field and sort logs based on it.

That sounds exactly like what the date filter already does.

> Kibana time is brower time, it can't be used for that purpose.

That's configurable.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:42am UTC](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash/58570/5 "2017-07-06T04:42:18Z")

</div>


