# Handling multiple date formats in logstash

**URL:** <https://discuss.elastic.co/t/handling-multiple-date-formats-in-logstash/93238>\
**Category:** Logstash\
**Created:** [July 14, 2017, 7:31pm UTC](https://discuss.elastic.co/t/handling-multiple-date-formats-in-logstash/93238 "2017-07-14T19:31:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lleatherby](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lleatherby/32/20641_2.png) [@lleatherby](https://discuss.elastic.co/u/lleatherby)\
**Post date:** [July 14, 2017, 7:31pm UTC](https://discuss.elastic.co/t/handling-multiple-date-formats-in-logstash/93238/1 "2017-07-14T19:31:42Z")

</div>

I have a dataset with multiple date formats. if I use this filter:  
grok {  
match =\> [  
"message",  
"(?%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}T%{TIME:time})%{SPACE}%{GREEDYDATA:text}"  
]  
}

I get my own variable created for one set of date formats. Now I need to add in a second date format. I don't understand enough about the above syntax to know how to (or if I can) modify that syntax to have it create the p3timestamp variable for me.

And in case you are wondering, I found an example of the above syntax someplace on the web and modified it for my use. It works nicely.

Help/advice is greatly appreciated.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 14, 2017, 7:35pm UTC](https://discuss.elastic.co/t/handling-multiple-date-formats-in-logstash/93238/2 "2017-07-14T19:35:52Z")

</div>

> I get my own variable created for one set of date formats.

Well... you get four fields for the different timestamp components.

The grok filter supports specifying multiple expressions that will be evaluated one by one until there's a match (example below). Depending on the exact circumstances that might be your best option.

> **[Grok filter plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-match)**

---

<div class="post-metadata">

**Author:** ![lleatherby](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lleatherby/32/20641_2.png) [@lleatherby](https://discuss.elastic.co/u/lleatherby)\
**Post date:** [July 14, 2017, 9:17pm UTC](https://discuss.elastic.co/t/handling-multiple-date-formats-in-logstash/93238/3 "2017-07-14T21:17:00Z")

</div>

Thanks. I'll take a look at it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2017, 9:17pm UTC](https://discuss.elastic.co/t/handling-multiple-date-formats-in-logstash/93238/4 "2017-08-11T21:17:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.