# Extract timestamp from filename
**URL:** https://discuss.elastic.co/t/extract-timestamp-from-filename/56135
**Category:** Logstash
**Created:** [July 21, 2016, 8:01pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-filename/56135 "2016-07-21T20:01:47Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)
#### Post date: [July 21, 2016, 8:01pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-filename/56135/1 "2016-07-21T20:01:47Z")
Hi All,
currently i have filename with the below format
[XXXXXXXX][YYYYYYYYYY][2016\_07\_21][19\_21\_12][160721T192103][ZZZZ]AB\_RTRT.0.log.
is there a way, i can extract the datetimestamp and index it to a specific field in elastic search.
thanks
Subbu
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 21, 2016, 8:13pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-filename/56135/2 "2016-07-21T20:13:06Z")
I assume you're getting the filename in the `path` field. Use a grok filter to extract the timestamp from `path` into a field of its own.
---
### Author:  [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)
#### Post date: [July 22, 2016, 7:55am UTC](https://discuss.elastic.co/t/extract-timestamp-from-filename/56135/3 "2016-07-22T07:55:51Z")
thanks for the direction.
i used the below grok and i can fetch the year, month and date ([2016\_07\_21][19\_21\_12])
grok {
match =\> ["filename", "%{YEAR:year}_%{MONTHNUM:month}_%{MONTHDAY:day}"]
add\_field =\> ["date", "%{month}/%{day}/%{year} "]
}
but i am not sure how to fetch the hour, mins and secs.
can you please help?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 22, 2016, 8:13am UTC](https://discuss.elastic.co/t/extract-timestamp-from-filename/56135/4 "2016-07-22T08:13:11Z")
Always format regular expressions as code. If you look closely at your post you'll note that it doesn't represent reality. All underscores have disappeared.
Unsurprisingly, capturing a time works the same way as capturing a date. I suggest the following expression for capturing the whole timestamp string (including the square brackets):
```
(?\[%{YEAR}_%{MONTHNUM}_%{MONTHDAY}\]\[%{HOUR}_%{MINUTE}_%{SECOND}\])
```
This string can then be fed to the date filter.
---
### Author:  [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)
#### Post date: [July 22, 2016, 9:36pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-filename/56135/5 "2016-07-22T21:36:27Z")
thanks a lot it works.
i used this in grok,
match =\> ["filename", "(?[%{YEAR}_%{MONTHNUM}_%{MONTHDAY}][%{HOUR}_%{MINUTE}_%{SECOND}])"]
and applied this in a date filter
date{
```
match => ["temptimestamp", "[yyyy_MM_dd][HH_mm_ss]"]
target => "filetimestamp"
```
}
it works fine. thanks a lot.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:46am UTC](https://discuss.elastic.co/t/extract-timestamp-from-filename/56135/6 "2017-07-06T04:46:44Z")