# Grok filter match with joda datetime pattern?

**URL:** <https://discuss.elastic.co/t/grok-filter-match-with-joda-datetime-pattern/151749>\
**Category:** Logstash\
**Created:** [October 10, 2018, 5:26am UTC](https://discuss.elastic.co/t/grok-filter-match-with-joda-datetime-pattern/151749 "2018-10-10T05:26:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wurzelseppi](https://avatars.discourse-cdn.com/v4/letter/w/eada6e/32.png) [@Wurzelseppi](https://discuss.elastic.co/u/Wurzelseppi)\
**Post date:** [October 10, 2018, 5:26am UTC](https://discuss.elastic.co/t/grok-filter-match-with-joda-datetime-pattern/151749/1 "2018-10-10T05:26:31Z")

</div>

Hi guys,

I have this configuration (part of)

> filter {  
> if [type] == "gflogs"  
> {  
> grok {  
> match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:TimestampTemp}" }  
> }  
> date {  
> match =\> ["TimestampTemp", "ISO8601"]  
> remove\_field =\> ["TimestampTemp"]  
> }  
> }
> 
> else if [type] == "planauflogs"  
> {  
> grok {  
> match =\> { "message" =\> "%{'yyyyMMdd-HHmmss':TimestampTemp}" }  
> }  
> date {  
> match =\> ["TimestampTemp", "ISO8601"]  
> remove\_field =\> ["TimestampTemp"]  
> }

The filter for the type "gflogs" works, but I can´t get the filter for the type "planauflogs" working.  
Can anybody please (please please 🙂 ) help me out here ?

Many thanks in advance and greetings,

Wurzelseppi

---

<div class="post-metadata">

**Author:** ![Wurzelseppi](https://avatars.discourse-cdn.com/v4/letter/w/eada6e/32.png) [@Wurzelseppi](https://discuss.elastic.co/u/Wurzelseppi)\
**Post date:** [October 15, 2018, 5:22am UTC](https://discuss.elastic.co/t/grok-filter-match-with-joda-datetime-pattern/151749/2 "2018-10-15T05:22:31Z")

</div>

Just a question guys. In the meantime I solved it myself, but i wonder why there weren´t any responses here ?  
Please give me ping shortly if you can read this. Otherwise I have to wonder if anybody can read this at all .... 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2018, 5:22am UTC](https://discuss.elastic.co/t/grok-filter-match-with-joda-datetime-pattern/151749/3 "2018-11-12T05:22:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.