# Grok and date plugin

**URL:** https://discuss.elastic.co/t/grok-and-date-plugin/149505
**Category:** Logstash
**Created:** [September 21, 2018, 6:40pm UTC](https://discuss.elastic.co/t/grok-and-date-plugin/149505 "2018-09-21T18:40:44Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)
#### Post date: [September 21, 2018, 6:40pm UTC](https://discuss.elastic.co/t/grok-and-date-plugin/149505/1 "2018-09-21T18:40:44Z")

</div>

I need to pick the time from a file and use that for @timestamp. The format of time in file is below  
2018-08-30 00:01:23|abc|xy777777

match =\> ["message","%{TIMESTAMP\_ISO8601:time}|..........]  
}

```
date {
    match => ["time" , "ISO8601"]
    
}

```

Doesn't work.

also tried  
date {  
match =\> ["time" , "yyyy-MM-dd HH:mm:ss"]

```
}
```

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 21, 2018, 6:55pm UTC](https://discuss.elastic.co/t/grok-and-date-plugin/149505/2 "2018-09-21T18:55:04Z")

</div>

What does an example event produced by Logstash look like? Copy/paste from Kibana's JSON tab or use a `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

### Author: ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)
#### Post date: [September 21, 2018, 7:01pm UTC](https://discuss.elastic.co/t/grok-and-date-plugin/149505/3 "2018-09-21T19:01:39Z")

</div>

Hi,  
I use below

output {  
elasticsearch {  
index =\> "x-%{+YYYY.MM.dd}"  
hosts =\> ["localhost:9200"]  
}

---

<div class="post-metadata">

### Author: ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)
#### Post date: [September 21, 2018, 8:04pm UTC](https://discuss.elastic.co/t/grok-and-date-plugin/149505/4 "2018-09-21T20:04:55Z")

</div>

> [@magnusbaeck](#):
>
> stdout { codec =\> rubydebug }

For the first case, it gives below

"time": "2018-08-29 00:04:40",  
"@timestamp": "2018-09-21T19:58:11.545Z",

---

<div class="post-metadata">

### Author: ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)
#### Post date: [September 21, 2018, 8:17pm UTC](https://discuss.elastic.co/t/grok-and-date-plugin/149505/5 "2018-09-21T20:17:26Z")

</div>

> [@xyz2](#):
>
> date {  
> match =\> ["time" , "yyyy-MM-dd HH:mm:ss"]
> 
> ```auto
> }
> 
> ```

When I use  
date {  
match =\> ["time" , "yyyy-MM-dd HH:mm:ss"]

```auto
}

```

I receive the response below for input file data having 2018-08-29 00:06:52  
"time": "2018-08-29 00:06:52",  
"@timestamp": "2018-08-29T04:06:52.000Z",

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 22, 2018, 5:55pm UTC](https://discuss.elastic.co/t/grok-and-date-plugin/149505/6 "2018-09-22T17:55:28Z")

</div>

If your timezone is UTC-4 then things are working fine. `@timestamp` is always UTC.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 20, 2018, 5:55pm UTC](https://discuss.elastic.co/t/grok-and-date-plugin/149505/7 "2018-10-20T17:55:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.