\d+)"
}
}
date {
match => ["m_date","UNIX_MS","UNIX"]
timezone => "UTC"
}
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 25, 2017, 10:07am UTC](https://discuss.elastic.co/t/extract-unix-ms-using-grok-regex-use-it-as-date-using-date/83536/2 "2017-04-25T10:07:47Z")
> some how the m\_date field is added, but recognized as string instead of date
That's expected. Do you really need to keep `m_date` if you store the timestamp in `@timestamp`?
> i want also to replcae the @timestamp with this m\_date field
If the date filter can't parse a string it'll tell you why in the Logstash log.
---
### Author:  [@uda\_kay](https://discuss.elastic.co/u/uda_kay)
#### Post date: [April 25, 2017, 11:07am UTC](https://discuss.elastic.co/t/extract-unix-ms-using-grok-regex-use-it-as-date-using-date/83536/3 "2017-04-25T11:07:35Z")
> Do you really need to keep m\_date if you store the timestamp in @timestamp?
No, but how to convert, how to store 'm\_date' as '@timestamp' ?
> If the date filter can't parse a string it'll tell you why in the Logstash log.
That's the weird part , I see it on kibana as string, but there is no error in /var/log/logstash/logstash-plain.log
it looks like it is ignoring it, or override it...
Can I define the match from 'message' field inside the 'date' without using grok.
Or maybe there is another way (couldn't do it using console with (painless).
Maybe you can point me to other options i should check
Thank you very much
PS
Can i change string from epoch time to date on kibana
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 25, 2017, 12:18pm UTC](https://discuss.elastic.co/t/extract-unix-ms-using-grok-regex-use-it-as-date-using-date/83536/4 "2017-04-25T12:18:46Z")
> No, but how to convert, how to store 'm\_date' as '@timestamp' ?
Use the date filter. Your current configuration looks correct.
Please show an example event, either via copy/paste from Kibana's JSON tab or from a `stdout { codec => rubydebug }` output.
---
### Author:  [@uda\_kay](https://discuss.elastic.co/u/uda_kay)
#### Post date: [April 26, 2017, 7:19am UTC](https://discuss.elastic.co/t/extract-unix-ms-using-grok-regex-use-it-as-date-using-date/83536/5 "2017-04-26T07:19:27Z")
Thank you @magnusbaeck
At the end I've finally (my friend actually 🙂 ) got that:
The m\_date was a string, date read the UNIX\_MS only if it's a number
so through mutate I've convert it to integer
then i use date
(Also change the m\_date name to 'm\_date\_format', but i don't think it's part of the solution... )
Here is the code:
```
grok {
match => {
"message" => "GET1:\s\++(?\d+)\sGET2:\s(?\d+)-[a-fA-F\d]+-(?\d+)"
}
}
mutate {
convert => {"m_date" => "integer"}
}
date {
match => ["m_date","UNIX_MS"]
target => "m_date_format"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 24, 2017, 7:21am UTC](https://discuss.elastic.co/t/extract-unix-ms-using-grok-regex-use-it-as-date-using-date/83536/6 "2017-05-24T07:21:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.