# Help to parse a timestamp string with grok filter in logstash

**URL:** <https://discuss.elastic.co/t/help-to-parse-a-timestamp-string-with-grok-filter-in-logstash/33386>\
**Category:** Logstash\
**Created:** [October 30, 2015, 3:23pm UTC](https://discuss.elastic.co/t/help-to-parse-a-timestamp-string-with-grok-filter-in-logstash/33386 "2015-10-30T15:23:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Juan\_Diaz\_Gonzalez](https://avatars.discourse-cdn.com/v4/letter/j/ea5d25/32.png) [@Juan\_Diaz\_Gonzalez](https://discuss.elastic.co/u/Juan_Diaz_Gonzalez)\
**Post date:** [October 30, 2015, 3:23pm UTC](https://discuss.elastic.co/t/help-to-parse-a-timestamp-string-with-grok-filter-in-logstash/33386/1 "2015-10-30T15:23:41Z")

</div>

Hi,

I would like to parse this string with this timestamp for example:

> Fri, 30 Oct 2015 15:12:17 CET

But in the pattern [documentation](https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns) I am not able to find any pattern that it could serve to me.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 30, 2015, 6:07pm UTC](https://discuss.elastic.co/t/help-to-parse-a-timestamp-string-with-grok-filter-in-logstash/33386/2 "2015-10-30T18:07:11Z")

</div>

None of the stock patterns match your timestamp exactly, but DATESTAMP\_RFC2822 is very close:

```
%{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601_TIMEZONE}

```

Just replace ISO8601\_TIMEZONE with something that matches your timezone name. Or actually, since the date filter can't parse timezone names anyway you might as well use WORD to match it.

---

<div class="post-metadata">

**Author:** ![Juan\_Diaz\_Gonzalez](https://avatars.discourse-cdn.com/v4/letter/j/ea5d25/32.png) [@Juan\_Diaz\_Gonzalez](https://discuss.elastic.co/u/Juan_Diaz_Gonzalez)\
**Post date:** [November 3, 2015, 7:58am UTC](https://discuss.elastic.co/t/help-to-parse-a-timestamp-string-with-grok-filter-in-logstash/33386/3 "2015-11-03T07:58:06Z")

</div>

Ok, thanks for your help it´s so useful.

---

<div class="post-metadata">

**Author:** ![Thorsten\_Nickel](https://avatars.discourse-cdn.com/v4/letter/t/3be4f8/32.png) [@Thorsten\_Nickel](https://discuss.elastic.co/u/Thorsten_Nickel)\
**Post date:** [November 3, 2015, 8:12am UTC](https://discuss.elastic.co/t/help-to-parse-a-timestamp-string-with-grok-filter-in-logstash/33386/4 "2015-11-03T08:12:57Z")

</div>

One more thing, what I like to do is to have all the different dateformats matched against a single field, for seperating out the correct timestamps. So first I put any time / date relevant data parsed out to the timestamp field, then I put all the different 'versions' of date formats together like this:

```
date {
match => ["timestamp" , "EEE MMM dd HH:mm:ss y", "EEE MMM dd HH:mm:ss ZZZ yyyy", "EEE MMM d HH:mm:ss ZZZ yyyy", "dd/MMM/yyyy:HH:mm:ss Z", "YYYY-MM-dd HH:mm:ss", "YYYY-MM-dd HH:mm:ss Z", "YYYY-MMM-dd HH:mm:ss", "dd.MM.YY HH:mm:ss", "MMM dd, yyyy hh:mm:ss a", "dd.MM.YY-HH:mm:ss", "MMM dd HH:mm:ss"]
}

```

And yes, difference in output of date-commands like 'Nov 2, 2015' and 'Nov 10, 2015' bug me, as I have to use two different patterns for single and double digit day value.  
For your format, I think correct would be "EEE, dd MMM yyyy HH:mm:ss ZZZ"  
If in need, consult the joda time page referenced in the date filter doc.

Hope to help,  
Thorsten

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:24am UTC](https://discuss.elastic.co/t/help-to-parse-a-timestamp-string-with-grok-filter-in-logstash/33386/5 "2017-07-06T05:24:22Z")

</div>