# Date parsing log without date in it

**URL:** https://discuss.elastic.co/t/date-parsing-log-without-date-in-it/41435
**Category:** Logstash
**Created:** [February 10, 2016, 8:36pm UTC](https://discuss.elastic.co/t/date-parsing-log-without-date-in-it/41435 "2016-02-10T20:36:53Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![yammy](https://avatars.discourse-cdn.com/v4/letter/y/9fc29f/32.png) [@yammy](https://discuss.elastic.co/u/yammy)
#### Post date: [February 10, 2016, 8:36pm UTC](https://discuss.elastic.co/t/date-parsing-log-without-date-in-it/41435/1 "2016-02-10T20:36:53Z")

</div>

I have a log that I need to collect, however it only contains the timestamp at the begining with no date.  
**Example:**  
145231.hostname!process1.19022.2799412992.0: msg1 "INFO: msg2"

I am successfully parsing the data with the grok statement below:  
**Example:**  
%{HOUR}%{MINUTE}%{SECOND}.%{DATA:my\_host}!%{DATA:process}: %{DATA:msg1} %{GREEDYDATA:msg2}

What I am stuck on is how to use the date filter to set the timestamp on the event, using the data from the log entry and the present date. Does anyone have an example?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 11, 2016, 6:53am UTC](https://discuss.elastic.co/t/date-parsing-log-without-date-in-it/41435/2 "2016-02-11T06:53:18Z")

</div>

I don't remember what the date filter defaults to if you supply a pattern containing just hours and minutes, but you could always use a ruby filter to obtain the current date and assume that the log you're parsing is from today. Or, perhaps you could use the `path` field (containing the path to the input file) to figure out which day it is.

---

<div class="post-metadata">

### Author: ![yammy](https://avatars.discourse-cdn.com/v4/letter/y/9fc29f/32.png) [@yammy](https://discuss.elastic.co/u/yammy)
#### Post date: [February 11, 2016, 1:35pm UTC](https://discuss.elastic.co/t/date-parsing-log-without-date-in-it/41435/3 "2016-02-11T13:35:13Z")

</div>

Thanks Magnus

Do you know of any similar examples of this? I'm unsure of what it would look like.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 11, 2016, 7:11pm UTC](https://discuss.elastic.co/t/date-parsing-log-without-date-in-it/41435/4 "2016-02-11T19:11:27Z")

</div>

This should give you a `date` field with the current date (in the local timezone):

```ruby
filter {
  ruby {
    code => "
      event['date'] = Time.now.strftime('%Y-%m-%d')
    "
  }
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:12am UTC](https://discuss.elastic.co/t/date-parsing-log-without-date-in-it/41435/5 "2017-07-06T05:12:01Z")

</div>


