# Datestamp to timestamp

**URL:** <https://discuss.elastic.co/t/datestamp-to-timestamp/241550>\
**Category:** Logstash\
**Created:** [July 16, 2020, 9:06pm UTC](https://discuss.elastic.co/t/datestamp-to-timestamp/241550 "2020-07-16T21:06:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![merlock](https://avatars.discourse-cdn.com/v4/letter/m/fbc32d/32.png) [@merlock](https://discuss.elastic.co/u/merlock)\
**Post date:** [July 16, 2020, 9:06pm UTC](https://discuss.elastic.co/t/datestamp-to-timestamp/241550/1 "2020-07-16T21:06:03Z")

</div>

hello all, i have the next format of log

06/17/2020 00:00:00 - 1.6.250.107 o00044696e20022001200940005

my filter

match =\> { "message" =\> "._%{DATESTAMP:LOGTIME}._-.\*%{IP}.\*w(?.{10})(?\<Service\_ID\>.{5})(?.{3})(?\<TIME\_HARVEST\>.{4})(?\<IDLE\_HARVEST\>.{4})(?.{0,36})" }

Inglés

but I try to change to timestamp but it doesn't work for me

mutate {  
add\_field =\> ["LOGTIME", "%{YEAR} %{MONTH} %{MONTHDAY} %{TIME}"]  
}

```
date {
	match => ["LOGTIME", "yyyy MMM dd HH:mm:ss", "ISO8601"]
	remove_field => ["LOGTIME"]
}

```

![imagen](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a0acca323a35cc67171853114a4026cd1c827293.png)

---

<div class="post-metadata">

**Author:** ![merlock](https://avatars.discourse-cdn.com/v4/letter/m/fbc32d/32.png) [@merlock](https://discuss.elastic.co/u/merlock)\
**Post date:** [July 16, 2020, 9:55pm UTC](https://discuss.elastic.co/t/datestamp-to-timestamp/241550/2 "2020-07-16T21:55:30Z")

</div>

I solved it with various date options

```auto
 if [type] == "harvest" {
    grok {
      match => { "message" => ".*(?<TIMESTAMP_ISO8601:timestamp>%{MONTHNUM}/%{MONTHDAY}/%{YEAR} %{TIME}).*-.*%{IP}.*w(?<MAC>.{10})(?<Service_ID>.{5})(?<NCANAL>.{3})(?<TIME_HARVEST>.{4})(?<IDLE_HARVEST>.{4})(?<PROGRAMACION>.{0,36})" }	 
	}
	grok {
	  match => { "message" => ".*(?<TIMESTAMP_ISO8601:timestamp>%{MONTHNUM}/%{MONTHDAY}/%{YEAR} %{TIME}).*-.*%{IP}.*W(?<MAC>.{10})(?<Service_ID>.{5})(?<NCANAL>.{3})(?<TIME_HARVEST>.{4})(?<IDLE_HARVEST>.{4})(?<PROGRAMACION>.{0,36})"	}	
	}
	date {
		match => ["timestamp", "ISO8601", "MM/dd/yyyy HH:mm:ss","EEE MMM d HH:mm:ss YYYY", "yyyy-MM-dd HH:mm:ss.SSS", "yyyy/mm/dd/HH/mm/ss.SSS", "MMM d HH:mm:ss.SSS", "MMM dd HH:mm:ss.SSS" , "yyyy-MM-dd HH:mm:ss.SSS", "MMM dd HH:mm:ss,SSS", "yyyy-MM-dd HH:mm:ss,SSS", "yy-MM-dd HH:mm:ss.SSS", "yyyy-MM-dd HH:mm:ss"]
		target => "@timestamp"
		timezone => ["UTC"]
		remove_field => ["timestamp"]
	}

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 16, 2020, 11:12pm UTC](https://discuss.elastic.co/t/datestamp-to-timestamp/241550/3 "2020-07-16T23:12:35Z")

</div>

Welcome to our community! 😃

Thanks for sharing your solution as well.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2020, 11:12pm UTC](https://discuss.elastic.co/t/datestamp-to-timestamp/241550/4 "2020-08-13T23:12:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.