# How to convert Apache timestamp(HTTPDATE) to ISO8601 format log

**URL:** <https://discuss.elastic.co/t/how-to-convert-apache-timestamp-httpdate-to-iso8601-format-log/83146>\
**Category:** Logstash\
**Created:** [April 21, 2017, 5:16am UTC](https://discuss.elastic.co/t/how-to-convert-apache-timestamp-httpdate-to-iso8601-format-log/83146 "2017-04-21T05:16:00Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![yokawasa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yokawasa/32/17684_2.png) [@yokawasa](https://discuss.elastic.co/u/yokawasa)\
**Post date:** [April 21, 2017, 5:16am UTC](https://discuss.elastic.co/t/how-to-convert-apache-timestamp-httpdate-to-iso8601-format-log/83146/1 "2017-04-21T05:16:00Z")

</div>

Hi experts,

Currently I'm forwarding apache access log to output target with the configuration, and I'd like to convert current timestamp which is Apache timestamp format (HTTPDATE) to ISO8601 format and add it to output fields. Can you please guide me the way to achieve my goal?

```
input {
    file {
        path => "/var/log/apache2/access.log"
        start_position => "beginning"
    }
}

filter {
    mutate { replace => { "type" => "apache_access" } }
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
    date {
        match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
    }
}

output {
    # for debug
    stdout { codec => rubydebug }
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 21, 2017, 5:22am UTC](https://discuss.elastic.co/t/how-to-convert-apache-timestamp-httpdate-to-iso8601-format-log/83146/2 "2017-04-21T05:22:27Z")

</div>

Your current configuration looks fine to me. What isn't working? Show us an example event.

---

<div class="post-metadata">

**Author:** ![yokawasa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yokawasa/32/17684_2.png) [@yokawasa](https://discuss.elastic.co/u/yokawasa)\
**Post date:** [April 22, 2017, 9:49am UTC](https://discuss.elastic.co/t/how-to-convert-apache-timestamp-httpdate-to-iso8601-format-log/83146/3 "2017-04-22T09:49:55Z")

</div>

@magnusbaeck  
Thank you so much for your quick response! My explanation wasn't enough,  
What I would like to achieve is to convert 'timestamp' field (format:"dd/MMM/yyyy:HH:mm:ss Z") to ISO8601 format ("YYYY-MM-DDThh:mm:ssZ"). Really appreciate If you could guide me how to archieve it.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 24, 2017, 5:24am UTC](https://discuss.elastic.co/t/how-to-convert-apache-timestamp-httpdate-to-iso8601-format-log/83146/4 "2017-04-24T05:24:29Z")

</div>

Yes, I know what you want to achieve. What I don't know is what Logstash currently produces with your configuration. Show the result from your `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

**Author:** ![yokawasa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yokawasa/32/17684_2.png) [@yokawasa](https://discuss.elastic.co/u/yokawasa)\
**Post date:** [April 24, 2017, 6:43am UTC](https://discuss.elastic.co/t/how-to-convert-apache-timestamp-httpdate-to-iso8601-format-log/83146/5 "2017-04-24T06:43:01Z")

</div>

@magnusbaeck Thank you so much for your prompt reply. Here is an output with my current configuration:

```
{
        "message" => "167.220.232.218 - - [24/Apr/2017:15:39:30 +0900] \"GET /test/ HTTP/1.1\" 200 675 \"-\" \"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36\"",
       "@version" => "1",
     "@timestamp" => "2017-04-24T06:39:30.000Z",
           "path" => "/var/log/apache2/access.log",
           "host" => "yoichika-dev1",
           "type" => "apache_access",
       "clientip" => "167.220.232.218",
          "ident" => "-",
           "auth" => "-",
      "timestamp" => "24/Apr/2017:15:39:30 +0900",
           "verb" => "GET",
        "request" => "/test/",
    "httpversion" => "1.1",
       "response" => "200",
          "bytes" => "675",
       "referrer" => "\"-\"",
          "agent" => "\"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36\""
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 24, 2017, 8:41am UTC](https://discuss.elastic.co/t/how-to-convert-apache-timestamp-httpdate-to-iso8601-format-log/83146/6 "2017-04-24T08:41:41Z")

</div>

This is working perfectly fine. I don't know what you expected. If you wanted to convert the `timestamp` field in place rather than store the resulting date in `@timestamp` you need to use the date filter's `target` option.

---

<div class="post-metadata">

**Author:** ![yokawasa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yokawasa/32/17684_2.png) [@yokawasa](https://discuss.elastic.co/u/yokawasa)\
**Post date:** [April 25, 2017, 10:12am UTC](https://discuss.elastic.co/t/how-to-convert-apache-timestamp-httpdate-to-iso8601-format-log/83146/7 "2017-04-25T10:12:04Z")

</div>

date filter's target is exactly what I wanted. I've tried with specifying custom name with target and was able to achieve what I wanted. Thanks alot!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 23, 2017, 10:16am UTC](https://discuss.elastic.co/t/how-to-convert-apache-timestamp-httpdate-to-iso8601-format-log/83146/8 "2017-05-23T10:16:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.