# Grok Timestamp

**URL:** <https://discuss.elastic.co/t/grok-timestamp/265236>\
**Category:** Logstash\
**Created:** [February 23, 2021, 5:27pm UTC](https://discuss.elastic.co/t/grok-timestamp/265236 "2021-02-23T17:27:14Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 23, 2021, 7:13pm UTC](https://discuss.elastic.co/t/grok-timestamp/265236/2 "2021-02-23T19:13:17Z")

</div>

Your timestamp does not include a year, so you are going to have to add one. I would use a date filter to do that. There is an [issue](https://github.com/logstash-plugins/logstash-filter-date/issues/51) on github here that discusses some of the complexities of that. For example if you are in the first minute of a new year and an event has a timestamp from December 31st it is probably from the previous year. But basically it is making an educated guess about which year should be added and sometimes it _will_ get it wrong.

A date filter only keeps millisecond accuracy, so if you want more than that you will have to merge the time from the original field. The filter below parses the date, to get the year added, then converts the result back to a string. It then extracts the first 10 characters of it (2021-02-04) and combines it with everything except the first 5 characters of log\_timestamp (removing the `0204 `)

```
    date { match => ["log_timestamp", "MMdd HH:mm:ss.SSSSSS"] target => "[@metadata][timestamp]" }
    mutate { convert => { "[@metadata][timestamp]" => "string" } }
    mutate {
        gsub => [
            "[@metadata][timestamp]", "(.{10}).*", "\1",
            "log_timestamp", ".{5}(.*)", "\1"
        ]
    }
    mutate { replace => { "log_timestamp" => "%{[@metadata][timestamp]} %{log_timestamp}" } }

```

If you really do want 5 digits of sub-second precision instead of 6 then

```
    mutate { gsub => ["log_timestamp", "\d$", ""] }
```

---

_[View the full topic](https://discuss.elastic.co/t/grok-timestamp/265236)._