# How can I create a date object from my logs with this format?

**URL:** <https://discuss.elastic.co/t/how-can-i-create-a-date-object-from-my-logs-with-this-format/55810>\
**Category:** Logstash\
**Created:** [July 18, 2016, 10:34pm UTC](https://discuss.elastic.co/t/how-can-i-create-a-date-object-from-my-logs-with-this-format/55810 "2016-07-18T22:34:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![David\_McClain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/david_mcclain/32/8613_2.png) [@David\_McClain](https://discuss.elastic.co/u/David_McClain)\
**Post date:** [July 18, 2016, 10:34pm UTC](https://discuss.elastic.co/t/how-can-i-create-a-date-object-from-my-logs-with-this-format/55810/1 "2016-07-18T22:34:33Z")

</div>

I'm sure I'm overthinking this and missing something..  
I'm getting logs from a tomcat application where the timestamp is in this format:

2016-07-18 17:55:23.423 -0400

Right now, I'm parsing them as 2 separate fields (@timestamp and OFFSET) and I would like to either  
A) parse them together with grok,  
or  
B) use the date block to combine them somehow.

The end result is I want to have a date object that has taken the offset into account.

---

<div class="post-metadata">

**Author:** ![sombilat](https://avatars.discourse-cdn.com/v4/letter/s/779978/32.png) [@sombilat](https://discuss.elastic.co/u/sombilat)\
**Post date:** [July 19, 2016, 1:26pm UTC](https://discuss.elastic.co/t/how-can-i-create-a-date-object-from-my-logs-with-this-format/55810/2 "2016-07-19T13:26:02Z")

</div>

Hey David,

I have experienced this before.

What you need to do is encapsulate them like this:

(?%{DATE} %{TIME})

What happens here is it says, that I have a TIME and DATE format. And if there is, I need them to be Concatenated and call them "variableName".

I use this Handy tool, [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) so I dont have to keep running Logstash.

Thanks,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 21, 2016, 6:29pm UTC](https://discuss.elastic.co/t/how-can-i-create-a-date-object-from-my-logs-with-this-format/55810/3 "2016-07-21T18:29:59Z")

</div>

> (?%{DATE} %{TIME})

Always format stuff like this as code so it comes out the way you intended. I'm pretty sure you meant this:

```
(?<timestamp>%{DATE} %{TIME})

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:46am UTC](https://discuss.elastic.co/t/how-can-i-create-a-date-object-from-my-logs-with-this-format/55810/4 "2017-07-06T04:46:57Z")

</div>