# Create standard timestamp

**URL:** https://discuss.elastic.co/t/create-standard-timestamp/124071
**Category:** Logstash
**Created:** [March 15, 2018, 10:20am UTC](https://discuss.elastic.co/t/create-standard-timestamp/124071 "2018-03-15T10:20:01Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![tharu85](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tharu85](https://discuss.elastic.co/u/tharu85)
#### Post date: [March 15, 2018, 10:20am UTC](https://discuss.elastic.co/t/create-standard-timestamp/124071/1 "2018-03-15T10:20:02Z")

</div>

In my logstash, I used KV filter to parse the log and now I have 2 fields for date and time.

```
"date" => "2017-10-10",
"time" => "12:18:23",

```

But I need to build standard timestamp from those date and time fields as below.

```
"log_timestamp" => 2017-10-10T12:18:23.324Z,

```

I tried following syntax under logstash filter and it does not work and gave \_dateparsefailure" under tags.

```
mutate {
      add_field => ["log_timestamp", "%{date} %{time}"]
}
date {
      match => ["log_timestamp", "yyyy-MM-dd'T'HH:mm:ss.SSSSSSZZ"]
}

```

gave following error under "tags"

```
"tags" => [
    [0] "_dateparsefailure"
],

```

Appreciate if any one guide me to meet my requirement.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 15, 2018, 10:32am UTC](https://discuss.elastic.co/t/create-standard-timestamp/124071/2 "2018-03-15T10:32:01Z")

</div>

The timestamp pattern in the date filter is supposed to match the timestamp you want to parse ("2017-10-10 12:18:23"). It doesn't describe the desired output format.

---

<div class="post-metadata">

### Author: ![tharu85](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tharu85](https://discuss.elastic.co/u/tharu85)
#### Post date: [March 15, 2018, 10:35am UTC](https://discuss.elastic.co/t/create-standard-timestamp/124071/3 "2018-03-15T10:35:51Z")

</div>

The syntax which I tried have additional parameters. Example mili-seconds and 'T'. What is the purpose of putting 'T' in between date and time. and will i able to set .000 as mili-seconds after time

```
date {
  match => ["log_timestamp", "yyyy-MM-dd'T'HH:mm:ss.SSSSSSZZ"]
}
```

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 15, 2018, 2:04pm UTC](https://discuss.elastic.co/t/create-standard-timestamp/124071/4 "2018-03-15T14:04:58Z")

</div>

> What is the purpose of putting 'T' in between date and time.

That's part of the ISO8601 standard.

> and will i able to set .000 as mili-seconds after time

If you don't include SSS in your date pattern the milliseconds will default to zero.

So, to be very explicit your date pattern should be: YYYY-MM-dd HH:mm:ss

---

<div class="post-metadata">

### Author: ![tharu85](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tharu85](https://discuss.elastic.co/u/tharu85)
#### Post date: [March 16, 2018, 2:50am UTC](https://discuss.elastic.co/t/create-standard-timestamp/124071/5 "2018-03-16T02:50:54Z")

</div>

I have fixed it my self, after tried several syntax

```
 date {
		match => ["log_timestamp", "ISO8601", "YYYY-MM-dd HH:mm:ss", "YYYY-MM-dd HH:mm:ss.ZZZ"]
		target => "log_timestamp"
	}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 13, 2018, 2:58am UTC](https://discuss.elastic.co/t/create-standard-timestamp/124071/6 "2018-04-13T02:58:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
