# Converting string to date **URL:** \ **Category:** Logstash\ **Created:** [August 3, 2015, 7:56pm UTC](https://discuss.elastic.co/t/converting-string-to-date/26748 "2015-08-03T19:56:07Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![FrankC](https://avatars.discourse-cdn.com/v4/letter/f/ed655f/32.png) [@FrankC](https://discuss.elastic.co/u/FrankC)\ **Post date:** [August 3, 2015, 7:56pm UTC](https://discuss.elastic.co/t/converting-string-to-date/26748/1 "2015-08-03T19:56:07Z")
Hi, I am getting started with logstash and I am looking for some help. I loaded the log file to ES but the logtimestamp field is a string. I want it to be a date. I understood how to convert to numeric data, but have not found anything for string-to-date conversion. Sample data from the log file (parts were cut off to shorten the message): Jul 1, 2015 5:15:04 PM org.apache.catalina.loader.WebappClassLoader loadClass INFO: Illegal access: this web application instance has been stopped already. Could not load .... Jul 2, 2015 6:15:04 PM org.apache.catalina.loader.WebappClassLoader findResourceInternal INFO: something bad: this web application instance has been stopped already. Could not load ... I used mutliline first to merge the lines and then grok to parse the message field using patterns: snippet from my config file: grok { patterns\_dir =\> "my\_grok\_patterns" match =\> { "message" =\> "%{CATALINA\_DATESTAMP:logtimestamp} %{JAVACLASS:java\_domain} %{WORD:java\_class}%{GREEDYDATA:error\_msg}" } } Thanks in advance for any pointers. Frank. ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [August 3, 2015, 8:18pm UTC](https://discuss.elastic.co/t/converting-string-to-date/26748/2 "2015-08-03T20:18:25Z")
That's what the [date](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) filter is for. ---
**Author:** ![FrankC](https://avatars.discourse-cdn.com/v4/letter/f/ed655f/32.png) [@FrankC](https://discuss.elastic.co/u/FrankC)\ **Post date:** [August 3, 2015, 8:48pm UTC](https://discuss.elastic.co/t/converting-string-to-date/26748/3 "2015-08-03T20:48:08Z")
Thanks for the reply. I tried the following. Dropped the index and related mapping. Add a date filter: date { match =\> ["logtimestamp", "MMM dd, YYYY hh:mm:ss Z"] } The logtimestamp field is still defined as a string Regards, Frank ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [August 3, 2015, 10:19pm UTC](https://discuss.elastic.co/t/converting-string-to-date/26748/4 "2015-08-03T22:19:54Z")
If you want to have "logtimestamp" become a time object, you need to add `target => "logtimestamp"` to your date filter block. By default, the date filter overwrites the `@timestamp` field with the value of the matched field, in this case, `logtimestamp`'s value. Check to see if `@timestamp` matches the string value in "logtimestamp". ---
**Author:** ![FrankC](https://avatars.discourse-cdn.com/v4/letter/f/ed655f/32.png) [@FrankC](https://discuss.elastic.co/u/FrankC)\ **Post date:** [August 4, 2015, 4:15pm UTC](https://discuss.elastic.co/t/converting-string-to-date/26748/5 "2015-08-04T16:15:41Z")
Hi Aaron. I got it to work. Thanks for your help!! For completeness I added the steps below. # 1. Multiline filter to combine the multi line messages into one line multiline { patterns\_dir =\> "path\_to\_grok\_patterns" pattern =\> "(^%{TOMCAT\_DATESTAMP})|(^%{CATALINA\_DATESTAMP})" negate =\> true what =\> "previous" } # 2. Parsed the message into separate fields using available patterns grok { patterns\_dir =\> "path\_to\_grok\_patterns" match =\> { "message" =\> "%{CATALINA\_DATESTAMP:timestamp} %{JAVACLASS:java\_class} %{WORD:java\_method}%{GREEDYDATA:error\_msg}" } } # 3. Replaced the @timestamp logstash field with the timestamp data from the file date { match =\> ["timestamp", "MMM dd, yyyy HH:mm:ss a"] } Regards, Frank ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [August 4, 2015, 4:29pm UTC](https://discuss.elastic.co/t/converting-string-to-date/26748/6 "2015-08-04T16:29:20Z")
Glad it worked out for you! For bonus points, you can remove the now-superfluous `timestamp` field (since you overwrote `@timestamp`), by adding `remove_field => "timestamp"` to your date filter block. This will _only_ delete the `timestamp` field upon successful conversion. This way you're not filling up your indices with a redundant timestamp field. ---
**Author:** ![Mayank\_Agrawal](https://avatars.discourse-cdn.com/v4/letter/m/3ab097/32.png) [@Mayank\_Agrawal](https://discuss.elastic.co/u/Mayank_Agrawal)\ **Post date:** [October 3, 2016, 11:57am UTC](https://discuss.elastic.co/t/converting-string-to-date/26748/7 "2016-10-03T11:57:50Z")
Sorry, for questioning on a closed thread. date filter automatically converts the time from logs as per the time zone. For example: In log, if time stamp is '2016-09-15 09:40:24,118' then output of date filter is '2016-09-15T04:10:24.118Z' Please note that timezone is UTC+05:30. I want to convert this string field to date for sorting purpose (that's why i am using date filter) and **keep the same timestamp as it is in the logs**. Any help would be appreciated. 🙂 ---
**Author:** ![Mayank\_Agrawal](https://avatars.discourse-cdn.com/v4/letter/m/3ab097/32.png) [@Mayank\_Agrawal](https://discuss.elastic.co/u/Mayank_Agrawal)\ **Post date:** [October 3, 2016, 12:12pm UTC](https://discuss.elastic.co/t/converting-string-to-date/26748/8 "2016-10-03T12:12:31Z")
Solved the issue. Marking timezone as UTC (i.e. timezone =\> "UTC" ) would solve the above mentioned problem. But is it ok to manipulate settings in such a way (to get the desired output) ??? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:36am UTC](https://discuss.elastic.co/t/converting-string-to-date/26748/9 "2017-07-06T04:36:07Z")