# Grok Date and time format

**URL:** <https://discuss.elastic.co/t/grok-date-and-time-format/46816>\
**Category:** Logstash\
**Created:** [April 8, 2016, 1:57pm UTC](https://discuss.elastic.co/t/grok-date-and-time-format/46816 "2016-04-08T13:57:06Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jpuch](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@Jpuch](https://discuss.elastic.co/u/Jpuch)\
**Post date:** [April 8, 2016, 1:57pm UTC](https://discuss.elastic.co/t/grok-date-and-time-format/46816/1 "2016-04-08T13:57:06Z")

</div>

Hello,

i have this king of log :  
`Aug 14 00:00:01 10.33.2.254 date=2015-08-14,time=00: 03:01, ...`

I'm not interrested in the first date and time (Aug 14 00:00:01) but by the second one : ( date=2015-08-14 and time=00: 03:01)

my first problem was the " " in this time field.

i removed it with :

```
filter {
  mutate {
    gsub => [
      "time", " ", ""
    ]
  }
}

```

now, i would like to merge date and time as a an unique date field and not as a string, so it can be usable in kibana.

thanks for reading

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 9, 2016, 7:20am UTC](https://discuss.elastic.co/t/grok-date-and-time-format/46816/2 "2016-04-09T07:20:49Z")

</div>

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-merge](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-merge) maybe?

---

<div class="post-metadata">

**Author:** ![Jpuch](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@Jpuch](https://discuss.elastic.co/u/Jpuch)\
**Post date:** [April 11, 2016, 1:40pm UTC](https://discuss.elastic.co/t/grok-date-and-time-format/46816/3 "2016-04-11T13:40:06Z")

</div>

Hi,

I tried this :

```
filter{
  mutate {
    gsub => [
      "time", " ", ""
    ]
  merge => ["date", "%{date} %{time}"]
  }
  date {
    match => ["date" , "yyyy-MM-dd HH:mm:ss"]
    locale => "en"
  }
}

```

but in my date field i still have the space in my time field :

![](https://us1.discourse-cdn.com/elastic/original/2X/0/048acaa60d6897d3b25a75862952c319c60141c0.JPG)

but when i look only at my time field the space isn't there :

![](https://us1.discourse-cdn.com/elastic/original/2X/c/c645a60562cb61735d226cd91eb14fec27528600.JPG)

How can i precise to grok that i want to take the time field without the space in.

Thanks

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 11, 2016, 1:45pm UTC](https://discuss.elastic.co/t/grok-date-and-time-format/46816/4 "2016-04-11T13:45:27Z")

</div>

Commands within a mutate block can be executed in any order, so try defining two mutate blocks, the first with the `gsub` and the second with the `merge`.

---

<div class="post-metadata">

**Author:** ![Alex\_6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_6/32/1330_2.png) [@Alex\_6](https://discuss.elastic.co/u/Alex_6)\
**Post date:** [April 11, 2016, 3:58pm UTC](https://discuss.elastic.co/t/grok-date-and-time-format/46816/5 "2016-04-11T15:58:30Z")

</div>

I'm being slightly off-topic, you're saying that order isn't guaranteed in a single mutate block? Uh oh... I have some changes to make now...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/grok-date-and-time-format/46816/6 "2017-07-06T05:02:54Z")

</div>