# Help with Date

**URL:** https://discuss.elastic.co/t/help-with-date/66240
**Category:** Logstash
**Created:** [November 16, 2016, 11:17am UTC](https://discuss.elastic.co/t/help-with-date/66240 "2016-11-16T11:17:03Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![debarun](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@debarun](https://discuss.elastic.co/u/debarun)
#### Post date: [November 16, 2016, 11:17am UTC](https://discuss.elastic.co/t/help-with-date/66240/1 "2016-11-16T11:17:03Z")

</div>

Hi,

I need to replace the time coming from the logs to timestamp field.

But i keep getting a parse failure.

The loglines look like

> Time Stamp 11/14/16 15:14:25 Event Number 2004

I am using the following filters:-

> grok {  
> patterns\_dir =\> ["/etc/logstash/conf.d/pattern"]  
> match =\> ["message","Time Stamp %{DATE:logdate} %{TIME:logtime} Event Number %{NUMBER:enevtnumber}]  
> }

> mutate {  
> add\_field =\> {  
> "timestamp" =\> "%{logdate} %{logtime}"  
> }}

> date {  
> locale =\> "en"  
> match =\> ["timestamp" , "dd/mm/yy HH24:mi:ss"]  
> }

---

<div class="post-metadata">

### Author: ![debarun](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@debarun](https://discuss.elastic.co/u/debarun)
#### Post date: [November 16, 2016, 5:23pm UTC](https://discuss.elastic.co/t/help-with-date/66240/2 "2016-11-16T17:23:40Z")

</div>

Hi,

Any help is welcome.

Regards,  
Debarun.

---

<div class="post-metadata">

### Author: ![txisme](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@txisme](https://discuss.elastic.co/u/txisme)
#### Post date: [November 16, 2016, 5:47pm UTC](https://discuss.elastic.co/t/help-with-date/66240/3 "2016-11-16T17:47:58Z")

</div>

i have this and it works:

```
 date
                    {
                            match => ["time3", "UNIX_MS"]
                                    target => "myTime"
                    }

```

so try to add the target line to create your timestamp variable.

---

<div class="post-metadata">

### Author: ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans)
#### Post date: [November 17, 2016, 5:49pm UTC](https://discuss.elastic.co/t/help-with-date/66240/4 "2016-11-17T17:49:59Z")

</div>

Maybe this will work for you:  
`date { locale => "en" match => ["timestamp", "dd/MM/YY HH:mm:ss", "ISO8601"] timezone => "Africa/Windhoek" target => "@timestamp" add_field => { "debug" => "timestampMatched"} }`

---

<div class="post-metadata">

### Author: ![aeva\_assured](https://avatars.discourse-cdn.com/v4/letter/a/35a633/32.png) [@aeva\_assured](https://discuss.elastic.co/u/aeva_assured)
#### Post date: [November 17, 2016, 7:19pm UTC](https://discuss.elastic.co/t/help-with-date/66240/5 "2016-11-17T19:19:01Z")

</div>

In the example you posted you are missing the trailing quotation in your match pattern.

> [@](#):
>
> match =\> ["message","Time Stamp %{DATE:logdate} %{TIME:logtime} Event Number %{NUMBER:enevtnumber}]

should be

> [@](#):
>
> match =\> ["message","Time Stamp %{DATE:logdate} %{TIME:logtime} Event Number %{NUMBER:enevtnumber}"]

---

<div class="post-metadata">

### Author: ![debarun](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@debarun](https://discuss.elastic.co/u/debarun)
#### Post date: [November 18, 2016, 11:07am UTC](https://discuss.elastic.co/t/help-with-date/66240/6 "2016-11-18T11:07:12Z")

</div>

Hi Guys,

Thanks for the response.

@Hans

This one worked , Thanks once again.

regards,  
Debarun

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 16, 2016, 11:07am UTC](https://discuss.elastic.co/t/help-with-date/66240/7 "2016-12-16T11:07:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.