# How do I create a global date based on file header **URL:** \ **Category:** Logstash\ **Created:** [September 19, 2016, 5:36pm UTC](https://discuss.elastic.co/t/how-do-i-create-a-global-date-based-on-file-header/60928 "2016-09-19T17:36:01Z")\ **Posts on this page:** 1\ **Showing post:** 7
**Author:** ![Mark\_Dolan](https://avatars.discourse-cdn.com/v4/letter/m/bbce88/32.png) [@Mark\_Dolan](https://discuss.elastic.co/u/Mark_Dolan)\ **Post date:** [September 20, 2016, 4:09pm UTC](https://discuss.elastic.co/t/how-do-i-create-a-global-date-based-on-file-header/60928/7 "2016-09-20T16:09:46Z")
Ah I see what you mean. Likewise I wanted to avoid doing any pre-processing because I feel that logstash should be able to manage to process arbitrary input somehow. If it can't then there's something wrong with its design. My own issue is here: > [@Wondering if it's possible to parse this type of data](https://discuss.elastic.co/t/wondering-if-its-possible-to-parse-this-type-of-data/60927): > > I have some data from the IBM nmon Linux/AIX monitoring tool. It's a strange hybrid format with several different delimited and headerless fields. For example: ZZZZ,T0002,00:05:06,04-AUG-2016 CPU001,T0002,0.6,0.2,0.0,99.2 CPU002,T0002,0.6,0.2,0.0,99.2 CPU003,T0002,0.5,0.2,0.0,99.3 CPU004,T0002,0.3,0.3,0.0,99.4 CPU005,T0002,0.6,0.3,0.0,99.1 CPU006,T0002,0.3,0.1,0.0,99.5 CPU007,T0002,0.7,0.5,0.0,98.8 CPU\_ALL,T0002,0.5,0.2,0.0,99.2,,7 MEM,T0002,5851.9,-0.0,-0.0,2047.0,1580.1,-0.0,-0.0,1984.7,-0.0… It seems to me that logstash struggles with anything that isn't a simple predictable log format of _timestamp_ followed by some _data_ but even my situation does have that format, just not quite in the way logstash wants it. Thanks for the info, I'll look into using a cronned sed script or something to preprocess the data. --- _[View the full topic](https://discuss.elastic.co/t/how-do-i-create-a-global-date-based-on-file-header/60928)._