# How should I parse date time for below string
**URL:** https://discuss.elastic.co/t/how-should-i-parse-date-time-for-below-string/46336
**Category:** Logstash
**Created:** [April 5, 2016, 7:24am UTC](https://discuss.elastic.co/t/how-should-i-parse-date-time-for-below-string/46336 "2016-04-05T07:24:56Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@macymin](https://discuss.elastic.co/u/macymin)
#### Post date: [April 5, 2016, 7:24am UTC](https://discuss.elastic.co/t/how-should-i-parse-date-time-for-below-string/46336/1 "2016-04-05T07:24:56Z")
In my file, the content is like this:
# 2016040417350700, \> '/home/prbdata/esda/prod/spool.6/esda/f12masc1d0/7882201\_001\_' [1:2:1]
how can I parse 2016040417350700 into a field with correct date time format ?
---
### Author:  [@macymin](https://discuss.elastic.co/u/macymin)
#### Post date: [April 5, 2016, 7:45am UTC](https://discuss.elastic.co/t/how-should-i-parse-date-time-for-below-string/46336/2 "2016-04-05T07:45:39Z")
I can parse it into each Year Month Date field, but not sure how to combine them into a complete timestamp field.
---
### Author:  [@mick66](https://discuss.elastic.co/u/mick66)
#### Post date: [April 5, 2016, 11:05am UTC](https://discuss.elastic.co/t/how-should-i-parse-date-time-for-below-string/46336/3 "2016-04-05T11:05:54Z")
If you check out this page you will see that there are a lot of regex patterns already defined
[http://grokdebug.herokuapp.com/patterns#](http://grokdebug.herokuapp.com/patterns#)
So try changing your pattern to this:
`(?%{YEAR}%{MONTHNUM}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}(.[0-9]))`
This should give you a field called runtime that contains your timestamp value.
---
### Author:  [@macymin](https://discuss.elastic.co/u/macymin)
#### Post date: [April 6, 2016, 2:13am UTC](https://discuss.elastic.co/t/how-should-i-parse-date-time-for-below-string/46336/4 "2016-04-06T02:13:16Z")
hi Mick, thanks for your reply. I tried on the debugger, the runtime still shows numbers 2016040417350700, not in the date time format. I think your method is to use the logstash pattern instead of custom pattern to parse year, month, day, hour, minute, second, but it is still unable to combine those fields automatically into the full date time format.
---
### Author:  [@mick66](https://discuss.elastic.co/u/mick66)
#### Post date: [April 6, 2016, 8:23am UTC](https://discuss.elastic.co/t/how-should-i-parse-date-time-for-below-string/46336/5 "2016-04-06T08:23:14Z")
Sorry I misunderstood your requirement. Once you have the parsed the runtime field from your message you can then use the date filter to set the timestamp like this
```
filter {
grok {
match => ["message", "(?%{YEAR}%{MONTHNUM}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}(.[0-9]))"]
}
date {
match => ["runtime", "YYYYMMddHHmmssSS"]
target => "@timestamp"
}
}
```
---
### Author:  [@macymin](https://discuss.elastic.co/u/macymin)
#### Post date: [April 6, 2016, 9:08am UTC](https://discuss.elastic.co/t/how-should-i-parse-date-time-for-below-string/46336/6 "2016-04-06T09:08:02Z")
hi Mick,
I actually made it work in the end by below config but it looks so stupid and inefficient compared to your one. sorry I am new to logstash. Thanks for your help!
```
grok {
match => { "message" => ["^# ((?%{YEAR})(?%{MONTHNUM})(?%{MONTHDAY})(?%{HOUR})(?%{MINUTE})(?%{SECOND}))?(.[0-9])%{GREEDYDATA}"] }
}
grok {
match => { "message" => ["^# \d{16}, \[EVENT::METRIC\] 'STAGE':'(?%{BASE16FLOAT})'"]}
}
multiline {
pattern => "#\s\D"
what => "previous"
}
mutate {
add_field => { "EventDate" => "%{hour}:%{min}:%{second} %{month} %{day} %{year}"}
}
date {
match => ["EventDate", "HH:mm:ss MM dd yyyy"]
}
mutate {
remove_field => ["year","month","day","hour","min","second","EventDate"]
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/how-should-i-parse-date-time-for-below-string/46336/7 "2017-07-06T05:03:35Z")