# Date format issue for two different log types into same datefield in logstash

**URL:** <https://discuss.elastic.co/t/date-format-issue-for-two-different-log-types-into-same-datefield-in-logstash/50952>\
**Category:** Logstash\
**Created:** [May 25, 2016, 3:11pm UTC](https://discuss.elastic.co/t/date-format-issue-for-two-different-log-types-into-same-datefield-in-logstash/50952 "2016-05-25T15:11:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jyothish](https://avatars.discourse-cdn.com/v4/letter/j/3d9bf3/32.png) [@jyothish](https://discuss.elastic.co/u/jyothish)\
**Post date:** [May 25, 2016, 3:11pm UTC](https://discuss.elastic.co/t/date-format-issue-for-two-different-log-types-into-same-datefield-in-logstash/50952/1 "2016-05-25T15:11:46Z")

</div>

I have a common timedate field named TIME\_END for two different date format for two different log types ,, in the first format it comes in UNIX type eg : 1460555937090 (millisecond+last 3 digits in nanoseconds) and in case of second log format it comes like this.. 2016-05-13 11:22:28,398

So in Case of first fomrat i have specified

```
if[logtype]=="1" {
    	date {
    	    match => ["Time_End","UNIX"] // UNIX_MS in case of windows
    	    target => "Time_End"
        
    	}
    }

if[logtype]=="2" {

date {

      match => ["Time_End", "ISO8601", "YYYY-MM-dd HH:mm:Ss,SSS"]

      target => "Time_End"

      locale => "en"

    } 

```

i am bit confused here... sometimes i get an error in first format and sometimes in other.. can you please suggest me what should be my correct date condition for both..currently its going as string hence Kibana not able to use it as a timestamp. So i need help badly @ logstash end.

---

<div class="post-metadata">

**Author:** ![sinto\_paulson](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@sinto\_paulson](https://discuss.elastic.co/u/sinto_paulson)\
**Post date:** [May 26, 2016, 1:35pm UTC](https://discuss.elastic.co/t/date-format-issue-for-two-different-log-types-into-same-datefield-in-logstash/50952/2 "2016-05-26T13:35:37Z")

</div>

We are also facing similar issue. When we have different time formats in two logs , how to convert them to a common format ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 29, 2016, 10:25am UTC](https://discuss.elastic.co/t/date-format-issue-for-two-different-log-types-into-same-datefield-in-logstash/50952/4 "2016-05-29T10:25:12Z")

</div>

> ```
> match => ["Time_End", "ISO8601", "YYYY-MM-dd HH:mm:Ss,SSS"]
> 
> ```

"Ss,SSS" should be "ss,SSS".

> i am bit confused here... sometimes i get an error in first format and sometimes in other..

What error? Please be specific.

> can you please suggest me what should be my correct date condition for both..currently its going as string hence Kibana not able to use it as a timestamp. So i need help badly @ logstash end.

Use an index template to make sure the the `Time_End` field is mapping as a timestamp. Look at how the `@timestamp` field is mapped in Logstash's default index template.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/date-format-issue-for-two-different-log-types-into-same-datefield-in-logstash/50952/5 "2017-07-06T04:55:44Z")

</div>