# Grok Config to populate Date with Name of File

**URL:** https://discuss.elastic.co/t/grok-config-to-populate-date-with-name-of-file/109985
**Category:** Logstash
**Created:** [December 1, 2017, 9:30pm UTC](https://discuss.elastic.co/t/grok-config-to-populate-date-with-name-of-file/109985 "2017-12-01T21:30:09Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![sconrod](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sconrod/32/23910_2.png) [@sconrod](https://discuss.elastic.co/u/sconrod)
#### Post date: [December 1, 2017, 9:30pm UTC](https://discuss.elastic.co/t/grok-config-to-populate-date-with-name-of-file/109985/1 "2017-12-01T21:30:09Z")

</div>

HI Magnus, I saw your previous notes on this here: [Extract timestamp from filename](https://discuss.elastic.co/t/extract-timestamp-from-filename/56135/4) and I have tried to populate my date field with the date that is in the name of the log file like this but it is not working. Suggestions please?

File Name:  
Cangenbus-10-17-19.csv

My Mapping:

PUT cangenbus-v5  
{  
"mappings": {  
"doc": {  
"properties": {  
"Name": { "type": "text" },  
"Number": { "type": "integer","ignore\_malformed": true},  
"Path": { "type": "text" }  
}  
}  
}  
}

====================================

{  
"acknowledged": true,  
"shards\_acknowledged": true,  
"index": "cangenbus-v5"  
}

=======================================

My Configuration File for Logstash:

input {  
file {  
path =\> "/opt/sample-data/cangenbus-csv/\*.csv"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}  
filter {  
csv {  
separator =\> ","  
columns =\> ["Name","Number"]  
}

grok {  
match =\> ["filename", "(?[%{YEAR}%{MONTHNUM}%{MONTHDAY}])"]  
}  
date {  
target =\> "filetimestamp"  
}

output {  
elasticsearch {  
hosts =\> "[http://10.0.2.15:9200](http://10.0.2.15:9200)"  
index =\> "cangenbus-v5"  
}  
stdout {}  
}

========================

Error:

[2017-12-01T14:24:54,019][WARN][logstash.filters.csv] Error parsing csv {:field=\>"message", :source=\>"", :exception=\>#\<NoMethodError: undefined method `each\_index' for nil:NilClass\>}

Error:  
[FATAL] 2017-12-01 15:25:30.752 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of #, =\> at line 22, column 18 (byte 377) after filter {  
csv {  
separator =\> ","  
columns =\> ["Name","Number"]  
}

grok {  
match =\> ["filename", "(?[%{YEAR-}%{MONTHNUM-}%{MONTHDAY-}])"]  
}  
date {  
target =\> "filetimestamp"  
}

output {  
elasticsearch  
root@ubuntu-16:/etc/logstash/conf.d#

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 29, 2017, 9:30pm UTC](https://discuss.elastic.co/t/grok-config-to-populate-date-with-name-of-file/109985/2 "2017-12-29T21:30:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.