# How to extract timestamp and log level from message and add it as a filed
**URL:** https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639
**Category:** Logstash
**Created:** [October 14, 2022, 1:00pm UTC](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639 "2022-10-14T13:00:56Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Akumar22](https://discuss.elastic.co/u/Akumar22)
#### Post date: [October 14, 2022, 1:00pm UTC](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639/1 "2022-10-14T13:00:56Z")
Hi
I want to extract timestamp and log level from message and want to add it as a field can you please suggest some filter or grok pattern to do this
sample log :
`2022-10-12 12:02:32,611 [DEBUG][pool-5-thread-14][com.hybris.service.workflow.worker.order.InitiateFulfilmentWorker][][] after obtaining lock `
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 15, 2022, 2:58am UTC](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639/2 "2022-10-15T02:58:10Z")
Dissect, faster
```auto
dissect {
mapping => {
"message" => "%{time} [%{level}][%{thread}][%{method}][%{field1}][%{field2}] %{logmsg}"
}
```
Grok, should prefer for this case
```auto
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:time}%{SPACE}\[%{LOGLEVEL:loglevel}\]%{SPACE}\[%{DATA:tread}\]%{SPACE}\[%{DATA:method}\]%{SPACE}\[%{DATA:field1}\]%{SPACE}\[%{DATA:field2}\]%{SPACE}%{GREEDYDATA:logmsg}" }
}
```
Convert to the date format
```auto
date {
match => ["timestamp", "yyyy/MM/dd HH:mm:ss,SSS"]
target => "@timestamp"
remove_field => ["timestamp"]
}
```
---
### Author:  [@Akumar22](https://discuss.elastic.co/u/Akumar22)
#### Post date: [October 17, 2022, 8:03am UTC](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639/3 "2022-10-17T08:03:25Z")
I am getting this error after using this dissect and grok filter
```auto
Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:oms-server-logs, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"=>\" at line 16, column 9 (byte 286) after filter {\n dissect {\n mapping => {\n \"message\" => \"%{time} [%{level}][%{thread}][%{method}][%{field1}][%{field2}] %{logmsg}\"\n }\n \n grok ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:199:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:50:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:381:in `block in converge_state'"]}
```
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 17, 2022, 10:12am UTC](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639/4 "2022-10-17T10:12:55Z")
Add 1 more }
```auto
dissect {
mapping => {
"message" => "%{time} [%{level}][%{thread}][%{method}][%{field1}][%{field2}] %{logmsg}"
}
}
```
---
### Author:  [@Akumar22](https://discuss.elastic.co/u/Akumar22)
#### Post date: [October 18, 2022, 9:30am UTC](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639/5 "2022-10-18T09:30:51Z")
> [@Rios](#):
>
> ```auto
> grok {
> match => { "message" => "%{TIMESTAMP_ISO8601:time}%{SPACE}\[%{LOGLEVEL:loglevel}\]%{SPACE}\[%{DATA:tread}\]%{SPACE}\[%{DATA:method}\]%{SPACE}\[%{DATA:field1}\]%{SPACE}\[%{DATA:field2}\]%{SPACE}%{GREEDYDATA:logmsg}" }
>
> }
>
> ```
Thank you this dissect is working
---
### Author:  [@Akumar22](https://discuss.elastic.co/u/Akumar22)
#### Post date: [October 18, 2022, 9:31am UTC](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639/6 "2022-10-18T09:31:27Z")
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
It should be like this
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 18, 2022, 9:47am UTC](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639/7 "2022-10-18T09:47:42Z")
Yes, sorry my mistake, copy+paste.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 15, 2022, 9:48am UTC](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639/8 "2022-11-15T09:48:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.