# Extract a timestamp between square brackets \[SOLVED\]

**URL:** <https://discuss.elastic.co/t/extract-a-timestamp-between-square-brackets-solved/135014>\
**Category:** Logstash\
**Created:** [June 7, 2018, 2:18pm UTC](https://discuss.elastic.co/t/extract-a-timestamp-between-square-brackets-solved/135014 "2018-06-07T14:18:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dr01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dr01/32/8482_2.png) [@dr01](https://discuss.elastic.co/u/dr01)\
**Post date:** [June 7, 2018, 2:18pm UTC](https://discuss.elastic.co/t/extract-a-timestamp-between-square-brackets-solved/135014/1 "2018-06-07T14:18:29Z")

</div>

I need to extract the timestamp from this line:

```
[Tue, 07 Jun 2018 15:53:29 +0200] codedeploy-agent started 

```

1)) I've tried the following filter:

```
mutate {
   copy => { "message" => "ts" }
   gsub => ["ts", "\[", ""]
   gsub => ["ts", "\].*", "" ]
}

```

but it has no effect: `ts` is identical to `message`.

2)) If I don't escape the square brackets and use the literal strings...

```
mutate {
   copy => { "message" => "ts" }
   gsub => ["ts", "[", ""]
   gsub => ["ts", "] codedeploy-agent started", "" ]
}

```

... the system throws an error `[ERROR][logstash.pipeline] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<RegexpError: premature end of char-class: /[/>`

3)) If I escape just the square brackets and use the literal string instead of the regex...

```
mutate {
   copy => { "message" => "ts" }
   gsub => ["ts", "\[", ""]
   gsub => ["ts", "\] codedeploy-agent started", "" ]
}

```

`ts` is identical to `message`, again.

4)) This filter:

```
dissect {
   mapping => { "message" => "\[%{ts} %{+ts} %{+ts} %{+ts} %{+ts} %{+ts}\] codedeploy-agent started" }
}

```

returns a `ts` which, strangely, contains `ue, 07 Jun 2018 15:53:29 +0200] codedeploy-agent started`.

5)) Without escaping the square brackets:

```
dissect {
   mapping => { "message" => "[%{ts} %{+ts} %{+ts} %{+ts} %{+ts} %{+ts}] codedeploy-agent started" }
}

```

I get a `ts` which is again identical to `message`.

There's probably an obvious solution, but what is it?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 7, 2018, 3:12pm UTC](https://discuss.elastic.co/t/extract-a-timestamp-between-square-brackets-solved/135014/2 "2018-06-07T15:12:53Z")

</div>

```auto
mutate {
   copy => { "message" => "ts" }
   gsub => ["ts", "\[", ""]
   gsub => ["ts", "\].*", "" ]
}

```

Mutate does operations in a fixed order, and it looks like gsub comes before copy, so split this into two mutates.

```auto
    mutate {
        copy => { "message" => "ts" }
    }
    mutate {
        gsub => ["ts", "\[", ""]
        gsub => ["ts", "\].*", "" ]
    }

```

---

<div class="post-metadata">

**Author:** ![dr01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dr01/32/8482_2.png) [@dr01](https://discuss.elastic.co/u/dr01)\
**Post date:** [June 8, 2018, 8:41am UTC](https://discuss.elastic.co/t/extract-a-timestamp-between-square-brackets-solved/135014/3 "2018-06-08T08:41:45Z")

</div>

Many thanks, it worked. It's very misleading that the mutate filter follows its own order to apply operations!

If there are two or more mutate filters, are they always applied in the order they're written? What about other plugins?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 8, 2018, 12:55pm UTC](https://discuss.elastic.co/t/extract-a-timestamp-between-square-brackets-solved/135014/4 "2018-06-08T12:55:52Z")

</div>

If they are written as separate filters they are applied in the order written.

The other case I can think of where order is ignored is the "common options" that most filters support. These are applied after the filter executes, and are conditional upon the filter working. Thus, for a date filter, you can remove\_field the text field that contains the date, and if you get a \_dateparsefailure the field will be left on the event, so that you can see what it failed to parse.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2018, 12:55pm UTC](https://discuss.elastic.co/t/extract-a-timestamp-between-square-brackets-solved/135014/5 "2018-07-06T12:55:56Z")

</div>

Closed on July 6, 2018, 12:55pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.