# Grok Pattern for below time stamp

**URL:** <https://discuss.elastic.co/t/grok-pattern-for-below-time-stamp/88865>\
**Category:** Logstash\
**Created:** [June 9, 2017, 3:55pm UTC](https://discuss.elastic.co/t/grok-pattern-for-below-time-stamp/88865 "2017-06-09T15:55:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ravikumar\_G](https://avatars.discourse-cdn.com/v4/letter/r/71e660/32.png) [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)\
**Post date:** [June 9, 2017, 3:55pm UTC](https://discuss.elastic.co/t/grok-pattern-for-below-time-stamp/88865/1 "2017-06-09T15:55:40Z")

</div>

Log FIle 👎

1496975411.858 cqtt=02:30:11 chi=127.0.0.1 cqhm=GET pssc=304 ttms=1 b=0 sssc=304 sscl=0 cfsc=FIN pfsc=FIN crc=TCP\_REFRESH\_HIT phr=DIRECT uas="teakd 1.9.2/2017-05-01/4e528b7-git" xmt="trace-id=c0a91be7-d68b-4f99-a3b4-ed34c1be98f6;parent-id=0;span-id=0x60f0db9dc92aa283"

1496975411.858

I have tried

date {  
match =\> ["timestamp", "UNIX"]  
}

Been kicked from logstash servers

{message}], :response=\>{"index"=\>{"\_index"=\>"logstash-%{vector}-2017-06-08", "\_type"=\>"custom\_ats\_2", "\_id"=\>"AVyIt25Nac58shWVO-gZ", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [timestamp]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "1496932309.605" is malformed at "932309.605""}}}}}  
[2017-06-08T10:02:57,946][WARN][logstash.outputs.elasticsearch] Failed action. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash-%{vector}-2017-06-08", :\_type=\>"custom\_ats\_2", :\_routing=\>nil}, 2017-06-08T14:31:49.625Z [ccdn-ats-tk-vbn-01.newcastlerdc.de.panjde.comcast.net](http://ccdn-ats-tk-vbn-01.newcastlerdc.de.panjde.comcast.net) %

---

<div class="post-metadata">

**Author:** ![Jaxon\_Kochel](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@Jaxon\_Kochel](https://discuss.elastic.co/u/Jaxon_Kochel)\
**Post date:** [June 9, 2017, 8:26pm UTC](https://discuss.elastic.co/t/grok-pattern-for-below-time-stamp/88865/2 "2017-06-09T20:26:59Z")

</div>

do you even have a timestamp?

---

<div class="post-metadata">

**Author:** ![Ravikumar\_G](https://avatars.discourse-cdn.com/v4/letter/r/71e660/32.png) [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)\
**Post date:** [June 13, 2017, 5:30pm UTC](https://discuss.elastic.co/t/grok-pattern-for-below-time-stamp/88865/3 "2017-06-13T17:30:45Z")

</div>

> [@Ravikumar\_G](#):
>
> 1496975411.858

Yes i can see this event time stamp after converting to human readable

1496975411.858

> **[Epoch Converter](https://www.epochconverter.com/)**
>
> Convert Unix Timestamps (and many other date formats) to regular dates.

---

<div class="post-metadata">

**Author:** ![Ravikumar\_G](https://avatars.discourse-cdn.com/v4/letter/r/71e660/32.png) [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)\
**Post date:** [June 13, 2017, 5:32pm UTC](https://discuss.elastic.co/t/grok-pattern-for-below-time-stamp/88865/4 "2017-06-13T17:32:19Z")

</div>

> [@Ravikumar\_G](#):
>
> 1496975411.858

1496975411.858  
Timestamp to Human date [batch convert timestamps to human dates]  
GMT: Friday, June 9, 2017 2:30:11.858 AM  
Your time zone: Thursday, June 8, 2017 10:30:11.858 PM GMT-04:00 DST

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2017, 5:32pm UTC](https://discuss.elastic.co/t/grok-pattern-for-below-time-stamp/88865/5 "2017-07-11T17:32:26Z")

</div>

Closed on July 11, 2017, 5:32pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.