# Creating a Persistent / Custom Variable when parsing a log file

**URL:** <https://discuss.elastic.co/t/creating-a-persistent-custom-variable-when-parsing-a-log-file/101030>\
**Category:** Logstash\
**Created:** [September 19, 2017, 1:40pm UTC](https://discuss.elastic.co/t/creating-a-persistent-custom-variable-when-parsing-a-log-file/101030 "2017-09-19T13:40:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sgrover](https://avatars.discourse-cdn.com/v4/letter/s/7993a0/32.png) [@sgrover](https://discuss.elastic.co/u/sgrover)\
**Post date:** [September 19, 2017, 1:40pm UTC](https://discuss.elastic.co/t/creating-a-persistent-custom-variable-when-parsing-a-log-file/101030/1 "2017-09-19T13:40:00Z")

</div>

Hi All - I have read through few questions and I think a similar question has been covered before - however I do not understand Ruby code to make sense of the responses. My problem is as follows:

SOURCE FIELD  
I am parsing a log file, where, every event includes a 'source' field, which is the name of the log file, e.g.:  
test.YYYYMMDD\_HHMMSS.log

What I want to do is: For each event, where 'source' contains this filename, extract the date and time in the following format within a new field:  
DD/MM/YYYY HH:MM:SS

I know how to write custom Regular Expressions (REs) in GROK, but I cannot write an RE which will match the data /and/ format it before storing it into a variable. So that is my problem.

Can anyone please help?

Thanks a lot!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 17, 2017, 1:40pm UTC](https://discuss.elastic.co/t/creating-a-persistent-custom-variable-when-parsing-a-log-file/101030/2 "2017-10-17T13:40:13Z")

</div>

Closed on October 17, 2017, 1:40pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
