# Converting string to Date in Logstash

**URL:** https://discuss.elastic.co/t/converting-string-to-date-in-logstash/169357
**Category:** Logstash
**Created:** [February 21, 2019, 9:34am UTC](https://discuss.elastic.co/t/converting-string-to-date-in-logstash/169357 "2019-02-21T09:34:32Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![vasudevan](https://avatars.discourse-cdn.com/v4/letter/v/f07891/32.png) [@vasudevan](https://discuss.elastic.co/u/vasudevan)
#### Post date: [February 21, 2019, 9:34am UTC](https://discuss.elastic.co/t/converting-string-to-date-in-logstash/169357/1 "2019-02-21T09:34:32Z")

</div>

We have log file in which we have to capture the first line matching "TIMESTAMP\_ISO8601" against build\_StartTime filed and last line matching "TIMESTAMP\_ISO8601" against build\_EndTime filed. After this we have to calculate the difference and should store the difference against duration filed. We tried with date filter but that's not working out we tried other many options which didn't worked. Can you help us here  
Log File:  
[2019-01-31 21:28:22Z INFO Program] Version: 2.122.1  
some logs in the middle  
[2019-01-31 21:28:45Z INFO Worker] Job completed.

Below is our current Logstash config File:  
input {  
beats {  
client\_inactivity\_timeout =\> 1200  
port =\> 5002  
}  
}

filter  
{  
if [message] =~ "Version: 2.122.1"  
{  
grok {  
add\_tag =\> ["start"]  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:build\_StartTime}" }  
}  
}  
grok {  
add\_tag =\> ["start"]  
break\_on\_match =\> false  
match =\> {  
"message" =\> [  
'"._.definitionName": "(?\<build\_DefinitionName\>._?)"',  
'"._.requestedFor": "(?\<build\_RequesterName\>._?)"'  
]  
}  
}

if [message] =~ "Job result after all post-job steps finish:"  
{  
grok {  
add\_tag =\> ["start"]  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:build\_EndTime}" }  
}  
grok {  
add\_tag =\> ["end"]  
match =\> { "message" =\> "Job result after all post-job steps finish:(?\<build\_Status\>.([A-Za-z]\*))" }  
}  
if ![build\_Status] or [build\_Status] == " "  
{  
mutate {  
add\_tag =\> ["start"]  
update =\> { "build\_Status" =\> "Succeeded" }  
}  
}  
}

if "start" in [tags] {  
aggregate {  
task\_id =\> "%{source}"  
code =\> "  
map['build\_DefinitionName'] = event.get('build\_DefinitionName') unless event.get('build\_DefinitionName').nil?  
map['build\_RequesterName'] = event.get('build\_RequesterName') unless event.get('build\_RequesterName').nil?  
map['build\_StartTime'] = event.get('build\_StartTime') unless event.get('build\_StartTime').nil?  
map['build\_EndTime'] = event.get('build\_EndTime') unless event.get('build\_EndTime').nil?  
map['build\_Status'] = event.get('build\_Status') unless event.get('build\_Status').nil?  
"  
}  
}

if "end" in [tags] {  
aggregate {  
task\_id =\> "%{source}"  
code =\> "  
event.set('build\_DefinitionName', map['build\_DefinitionName'])  
event.set('build\_RequesterName', map['build\_RequesterName'])  
event.set('build\_StartTime', map['build\_StartTime'])  
event.set('build\_EndTime', map['build\_EndTime'])  
event.set('build\_Status', map['build\_Status'])  
"  
end\_of\_task =\> true  
}  
}  
if "end" not in [tags] or [build\_DefinitionName] == 'nil' or ![build\_DefinitionName] {  
drop { }  
}  
mutate {  
remove\_field =\> ["message"]  
}  
mutate {  
remove\_tag =\> ["start"]  
}  
}

output {  
elasticsearch {  
hosts =\> ["elasticsearch:9200"]  
index =\> "tfslog-%{+YYYY.MM.dd}"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 21, 2019, 9:34am UTC](https://discuss.elastic.co/t/converting-string-to-date-in-logstash/169357/2 "2019-03-21T09:34:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.