# How to fetch syslog date from body in logstash filter

**URL:** <https://discuss.elastic.co/t/how-to-fetch-syslog-date-from-body-in-logstash-filter/76961>\
**Category:** Logstash\
**Created:** [March 1, 2017, 10:01am UTC](https://discuss.elastic.co/t/how-to-fetch-syslog-date-from-body-in-logstash-filter/76961 "2017-03-01T10:01:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sundar1](https://avatars.discourse-cdn.com/v4/letter/s/8dc957/32.png) [@sundar1](https://discuss.elastic.co/u/sundar1)\
**Post date:** [March 1, 2017, 10:01am UTC](https://discuss.elastic.co/t/how-to-fetch-syslog-date-from-body-in-logstash-filter/76961/1 "2017-03-01T10:01:48Z")

</div>

The below one is my json and fetch the date from the body and convert to logstash timestamp.  
**"Mar 1 04:57:10"** date should come as a @timestamp.  
{  
"host" =\> "[vc2cm.com](http://vc2cm.com)",  
"@version" =\> "1",  
"location" =\> "MMK",  
"body": "Mar 1 04:57:10 adinfo[19530]: INFO base.nocachemode Disabling the agent directory cache\n",  
}

Please help me.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 1, 2017, 1:14pm UTC](https://discuss.elastic.co/t/how-to-fetch-syslog-date-from-body-in-logstash-filter/76961/2 "2017-03-01T13:14:55Z")

</div>

Use the grok filter to parse the contents of the `body` field and extract the timestamp to a separate field, then use a date filter to parse the timestamp string into the `@timestamp` field. What you have is close to the syslog example here: [https://www.elastic.co/guide/en/logstash/current/config-examples.html#\_processing\_syslog\_messages](https://www.elastic.co/guide/en/logstash/current/config-examples.html#_processing_syslog_messages)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2017, 1:15pm UTC](https://discuss.elastic.co/t/how-to-fetch-syslog-date-from-body-in-logstash-filter/76961/3 "2017-03-29T13:15:02Z")

</div>

Closed on March 29, 2017, 1:15pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.