# Extract Sub string and reverse
**URL:** https://discuss.elastic.co/t/extract-sub-string-and-reverse/37033
**Category:** Logstash
**Created:** [December 12, 2015, 7:44am UTC](https://discuss.elastic.co/t/extract-sub-string-and-reverse/37033 "2015-12-12T07:44:54Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)
#### Post date: [December 12, 2015, 7:44am UTC](https://discuss.elastic.co/t/extract-sub-string-and-reverse/37033/1 "2015-12-12T07:44:54Z")
Hi
I have date & time filed in the log as below, which I have parsed to a filed in the logstash.
11-12-2015 10:00:00,301
However I want the date only in 2015-12-11 (YYYY-MM-DD) format into a variable, say event date in logstash.
How Can I extract the date and convert into YYYY-MM-DD (or reverse the string) and store into a variable.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 13, 2015, 4:03pm UTC](https://discuss.elastic.co/t/extract-sub-string-and-reverse/37033/2 "2015-12-13T16:03:37Z")
If you want to parse it into a complete timestamp use the date filter, otherwise use the grok filter to extract each component of the date into temporary fields and a mutate filter to put them back together in the desired order. Something like this:
```auto
grok {
match => ["name-of-field", "^%{MONTHNUM:month}-%{MONTHDAY:day}-%{YEAR:year}"]
}
mutate {
add_field => {
"event_time" => "%{year}-%{month}-%{day}"
}
remove_field => ["year", "month", "day"]
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:18am UTC](https://discuss.elastic.co/t/extract-sub-string-and-reverse/37033/3 "2017-07-06T05:18:41Z")