# Date transform

**URL:** <https://discuss.elastic.co/t/date-transform/85430>\
**Category:** Elasticsearch\
**Created:** [May 11, 2017, 3:00pm UTC](https://discuss.elastic.co/t/date-transform/85430 "2017-05-11T15:00:10Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 11, 2017, 3:00pm UTC](https://discuss.elastic.co/t/date-transform/85430/1 "2017-05-11T15:00:10Z")

</div>

Hello,  
I have this format of date,  
Thu May 4 13:38:33 2017 DISCONNECT S248/15 host 192.168.54.63/3300 (192.168.54.63)

Did it's possible to transform it on "YYYY-MM-dd HH:mm:ss" ?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 11, 2017, 3:30pm UTC](https://discuss.elastic.co/t/date-transform/85430/2 "2017-05-11T15:30:33Z")

</div>

date ingest processor can process a String to extract a Date from it.  
Is that what you mean?

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 11, 2017, 3:36pm UTC](https://discuss.elastic.co/t/date-transform/85430/3 "2017-05-11T15:36:23Z")

</div>

In fact, my date format is like that :  
Thu May 4 13:38:33 2017  
And i want to transform it on YYYY-MM-dd HH:mm:ss.  
Can we do transform it with the option "date" ?  
Because I have a grok who extract perfectly each field of the date .

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 11, 2017, 4:02pm UTC](https://discuss.elastic.co/t/date-transform/85430/4 "2017-05-11T16:02:05Z")

</div>

Why do you want to transform it as a String using this format `YYYY-MM-dd HH:mm:ss` instead of a Date that you can actually use to compute aggs or run range queries on it?

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 12, 2017, 7:16am UTC](https://discuss.elastic.co/t/date-transform/85430/5 "2017-05-12T07:16:41Z")

</div>

Because I want to replace my date in the timestamp, and i think that's it didn't work if the format is incorrect, right ?😕

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 12, 2017, 7:56am UTC](https://discuss.elastic.co/t/date-transform/85430/6 "2017-05-12T07:56:45Z")

</div>

But what for? I totally understood that you want to change `Thu May 4 13:38:33 2017` to `YYYY-MM-dd HH:mm:ss` but do you intend to just store that field as a String or do you actually want to be able to use it (filter by date, date\_histogram agg...)?

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 12, 2017, 7:59am UTC](https://discuss.elastic.co/t/date-transform/85430/7 "2017-05-12T07:59:42Z")

</div>

Yes, I want to be able to use it ((filter by date, etc) 🙂  
In fact, it's a file log.  
I have 2 field, the timestamp which take the time when the upload file and the datestamp (the real log time).  
I want to replace the timestamp by the datestamp

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 12, 2017, 8:45am UTC](https://discuss.elastic.co/t/date-transform/85430/8 "2017-05-12T08:45:15Z")

</div>

Then I'd use the Date Processor as I told in [Date transform](https://discuss.elastic.co/t/date-transform/85430/2?u=dadoonet)

[https://www.elastic.co/guide/en/elasticsearch/reference/5.4/date-processor.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.4/date-processor.html)

Or I'd change the mapping for the field and change its format so you don't have to pre-process it: [https://www.elastic.co/guide/en/elasticsearch/reference/5.4/mapping-date-format.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.4/mapping-date-format.html)

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 12, 2017, 8:47am UTC](https://discuss.elastic.co/t/date-transform/85430/9 "2017-05-12T08:47:11Z")

</div>

Okay i'll check , thanks my friend 😉

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 15, 2017, 11:24am UTC](https://discuss.elastic.co/t/date-transform/85430/10 "2017-05-15T11:24:50Z")

</div>

Where do you put the processor ?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 15, 2017, 12:07pm UTC](https://discuss.elastic.co/t/date-transform/85430/11 "2017-05-15T12:07:52Z")

</div>

In an ingest pipeline: [https://www.elastic.co/guide/en/elasticsearch/reference/5.4/ingest.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.4/ingest.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2017, 12:10pm UTC](https://discuss.elastic.co/t/date-transform/85430/12 "2017-06-12T12:10:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
