# Grok timestamp

**URL:** <https://discuss.elastic.co/t/grok-timestamp/72995>\
**Category:** Logstash\
**Created:** [January 27, 2017, 10:00am UTC](https://discuss.elastic.co/t/grok-timestamp/72995 "2017-01-27T10:00:06Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maher.Glenza](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\
**Post date:** [January 27, 2017, 10:00am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/1 "2017-01-27T10:00:06Z")

</div>

20170118154716225  
plz what is its format in grok ?

---

<div class="post-metadata">

**Author:** ![Maher.Glenza](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\
**Post date:** [January 27, 2017, 10:01am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/2 "2017-01-27T10:01:25Z")

</div>

to notice i want it to be a date  
YYYYMMDDHHmmssSSS

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 27, 2017, 10:11am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/3 "2017-01-27T10:11:28Z")

</div>

For example `(?<timestamp>%{YEAR}%{MONTHNUM}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}\d+)`.

Of course, this string also happens to be an integer so unless you want validation that the input string really is a YYYYMMDDHHmmssSSS timestamp you can just do `%{INT:timestamp}`.

---

<div class="post-metadata">

**Author:** ![Maher.Glenza](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\
**Post date:** [January 27, 2017, 10:13am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/4 "2017-01-27T10:13:43Z")

</div>

hi magnus  
i think you didn t understand me  
i want the input to be YYYYMMDDHHmmssSSS (for example 20170118154716225)  
and i want the grok to consider it as date

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 27, 2017, 10:17am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/5 "2017-01-27T10:17:08Z")

</div>

You have a log where each line contains a timestamp like e.g. 20170118154716225, yes? Then the grok expression samples I gave will extract that into a field named `timestamp` that you can feed to the date filter.

---

<div class="post-metadata">

**Author:** ![Maher.Glenza](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\
**Post date:** [January 27, 2017, 10:18am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/6 "2017-01-27T10:18:19Z")

</div>

okay thank you magnus !!!

---

<div class="post-metadata">

**Author:** ![Maher.Glenza](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\
**Post date:** [January 27, 2017, 10:20am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/7 "2017-01-27T10:20:12Z")

</div>

just one thing magnus plz  
where i put  
(?%{YEAR}%{MONTHNUM}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}\d+). ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 27, 2017, 10:25am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/8 "2017-01-27T10:25:24Z")

</div>

In your grok expression in your grok filter. The `(?<fieldname>...)` syntax I used is described in the grok filter documentation.

---

<div class="post-metadata">

**Author:** ![Maher.Glenza](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\
**Post date:** [January 27, 2017, 10:28am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/9 "2017-01-27T10:28:32Z")

</div>

sory i didn t understand this is my grok  
grok {   
match =\> ["message","%{TIMESTAMP\_ISO8601:datePvin} : %{UUID:id} %{INT:daterecepPvin} %{NUMBER:datefintraitPvin} %{NUMBER:delai} %{WORD:nomFlux} %{GREEDYDATA:evts} %{WORD:BU} %{NUMBER:reforigin} %{NOTSPACE:contractoidval} %{DATA:useroidval} %{DATA:errorStatus} %{GREEDYDATA:errorDesc} %{NOTSPACE:servname}"] }

and i want to do this treatment on %{INT:daterecepPvin} how the grok will become ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 27, 2017, 10:34am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/10 "2017-01-27T10:34:22Z")

</div>

So you're already capturing the timestamp into the `daterecepPvin` field? What more do you want to achieve?

---

<div class="post-metadata">

**Author:** ![Maher.Glenza](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\
**Post date:** [January 27, 2017, 10:36am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/11 "2017-01-27T10:36:00Z")

</div>

i don t want it to be INT but a DATE

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 27, 2017, 10:53am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/12 "2017-01-27T10:53:23Z")

</div>

The grok filter doesn't create dates. It creates strings, integers, and floats. If you the timestamp you have to become a date in ES you need to adjust your mappings or use the date filter to convert it into a string that ES will recognize as a date out of the box.

---

<div class="post-metadata">

**Author:** ![Maher.Glenza](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\
**Post date:** [January 27, 2017, 10:57am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/13 "2017-01-27T10:57:16Z")

</div>

i didn t recognize how to use the date filter i tried this grok {

```
		match => ["message","%{TIMESTAMP_ISO8601:datePvin} : %{UUID:id} %{timeStamp:daterecepPvin} %{NUMBER:datefintraitPvin} %{NUMBER:delai} %{WORD:nomFlux} %{GREEDYDATA:evts} %{WORD:BU} %{NUMBER:reforigin} %{NOTSPACE:contractoidval} %{DATA:useroidval} %{DATA:errorStatus} %{GREEDYDATA:errorDesc} %{NOTSPACE:servname}"]

}
date {

```

match =\> ["daterecepPvin" , "YYYYMMDDHHmmssSSS"]

}

```
}

```

but it didn t work

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 27, 2017, 11:06am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/14 "2017-01-27T11:06:18Z")

</div>

Check the Logstash log. If the date filter fails it'll give you clues.

---

<div class="post-metadata">

**Author:** ![Maher.Glenza](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\
**Post date:** [January 27, 2017, 11:07am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/15 "2017-01-27T11:07:04Z")

</div>

ok thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 24, 2017, 11:07am UTC](https://discuss.elastic.co/t/grok-timestamp/72995/16 "2017-02-24T11:07:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.