# Grok TIME
**URL:** https://discuss.elastic.co/t/grok-time/43994
**Category:** Logstash
**Created:** [March 10, 2016, 9:11am UTC](https://discuss.elastic.co/t/grok-time/43994 "2016-03-10T09:11:25Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)
#### Post date: [March 10, 2016, 9:11am UTC](https://discuss.elastic.co/t/grok-time/43994/1 "2016-03-10T09:11:25Z")
Hi All ,
I am new to ELK and trying to forward a non-real time log by applying grok in config file to pick the log time .I referred few previous discussions to find that Grok could be used to parse the data & Date{} could be used to overwrite with log time.
PFB the details of log & config file.
Please help me where I am missing .
Input Data-
A824209B7C244E64A1370281C2FF 3E975EA9197F4A91BF3869F14D67 ReadyForProcessing 12:30:14 AM
Config File:
input {
file {
path =\> "Location\Sample.csv"
```
start_position => "beginning"
}
```
}
output {
elasticsearch {
action =\> "index"
index =\> "newindex"
}
}
filter {
csv {
columns =\> ["ConversationID", "Conversation\_StateID", "Conversation\_Status\_Desc", "ConversationStateComments","CreationTime"]
separator =\> ","
}
grok {
```
match => { "message" => "%{TIME:timestamp:date}" }
}
date {
match => ["timestamp", "HH:mm:ss"]
}
```
}
Please help .
Thanks ,
Prateek
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 10, 2016, 6:35pm UTC](https://discuss.elastic.co/t/grok-time/43994/2 "2016-03-10T18:35:35Z")
Okay, I see the time at the end of the input string. But where does the date come from? Do you want to use today's date or what?
---
### Author:  [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)
#### Post date: [March 11, 2016, 5:07am UTC](https://discuss.elastic.co/t/grok-time/43994/3 "2016-03-11T05:07:08Z")
The date when the log is created ,its not a current date.
A824209B7C244E64A1370281C2FF 3E975EA9197F4A91BF3869F14D67 ReadyForProcessing 2016-02-25 12:30:14 AM
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 11, 2016, 6:32am UTC](https://discuss.elastic.co/t/grok-time/43994/4 "2016-03-11T06:32:10Z")
> A824209B7C244E64A1370281C2FF 3E975EA9197F4A91BF3869F14D67 ReadyForProcessing 2016-02-25 12:30:14 AM
So... the date _is_ in the log line after all?
---
### Author:  [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)
#### Post date: [March 11, 2016, 6:44am UTC](https://discuss.elastic.co/t/grok-time/43994/5 "2016-03-11T06:44:12Z")
Yes the date comes in a log line .
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 11, 2016, 7:19am UTC](https://discuss.elastic.co/t/grok-time/43994/6 "2016-03-11T07:19:35Z")
Okay, so what's the problem? You have the date in one field and the time in another?
---
### Author:  [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)
#### Post date: [March 11, 2016, 7:22am UTC](https://discuss.elastic.co/t/grok-time/43994/7 "2016-03-11T07:22:55Z")
No the date comes in same log line with time in a format YYYY-MM-DD HH:MM:SS
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 11, 2016, 7:30am UTC](https://discuss.elastic.co/t/grok-time/43994/8 "2016-03-11T07:30:45Z")
Yes, that's understood but what I don't understand is what you're asking. You're using the csv filter to parse the data so you should get the date in one field and the time in another?
---
### Author:  [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)
#### Post date: [March 11, 2016, 7:52am UTC](https://discuss.elastic.co/t/grok-time/43994/9 "2016-03-11T07:52:32Z")
Yes I am using csv filter to parse the data.
I want to get a time associated with logs primarily but through csv filter it is coming up in a string format & analysed field.
@timestamp is picking the current system's date and time so not able to correlate the data with log time.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 11, 2016, 8:15am UTC](https://discuss.elastic.co/t/grok-time/43994/10 "2016-03-11T08:15:14Z")
You're already attempting to use the date filter and that's indeed the correct approach. That filter requires the date and the time to be in one field. See [http://stackoverflow.com/a/28882096/414355](http://stackoverflow.com/a/28882096/414355) if you have the date and the time in different fields and need to combine them.
If you get stuck again and need further help you need to provide hard facts; the exact configuration, the exact input, the exact output you get (use a `stdout { codec => rubydebug }` output, not elasticsearch), and what you would like to get.
---
### Author:  [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)
#### Post date: [March 11, 2016, 9:05am UTC](https://discuss.elastic.co/t/grok-time/43994/11 "2016-03-11T09:05:31Z")
Thank you for your patience and help.
As per suggested I combined the fields in data file itself.
The slight change done for grok in config file(tried & verified first on grok debugger:-[http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/))
Filter Part of config file -
filter {
csv {
columns =\> ["ConversationID", "Conversation\_StateID", "Conversation\_Status\_Desc", "ConversationStateComments","CreationTime"]
separator =\> ","
}
grok {
```
match => { "message" => "%{DATESTAMP:timestamp:date}" }
}
date {
match => ["timestamp", "YY-MM-DD HH:mm:ss"]
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:07am UTC](https://discuss.elastic.co/t/grok-time/43994/12 "2017-07-06T05:07:24Z")