# How to make an own timestamp from old log file

**URL:** <https://discuss.elastic.co/t/how-to-make-an-own-timestamp-from-old-log-file/99543>\
**Category:** Logstash\
**Created:** [September 6, 2017, 9:23am UTC](https://discuss.elastic.co/t/how-to-make-an-own-timestamp-from-old-log-file/99543 "2017-09-06T09:23:33Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Muhammad\_Rizky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muhammad_rizky/32/21839_2.png) [@Muhammad\_Rizky](https://discuss.elastic.co/u/Muhammad_Rizky)\
**Post date:** [September 6, 2017, 9:23am UTC](https://discuss.elastic.co/t/how-to-make-an-own-timestamp-from-old-log-file/99543/1 "2017-09-06T09:23:34Z")

</div>

Hello, i want to store my own log file to logstash, then i use grok to mapping the date from log file to a field. But, in kibana, that field cannot read as a timestamp, so i can not use the real time stamp in timelion.  
here is my config file  
input{

file{  
path =\> "E:\LogFolder\xxx.log"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}

}

filter {  
grok {  
patterns\_dir =\> ["E:\ELK\patterns"]  
match =\> {  
"message" =\> "%{DATE\_YMD:my\_timestamp}"  
}  
}

```
  date {
   match => ["my_timestamp", "yyyy MM dd HH:mm:ss"]
   locale => "sv"
}

```

}

output{

```
elasticsearch{
	hosts => ["localhost:9200"]
	index => "file_poller_bw"
}

stdout {
	codec => rubydebug
}

```

}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 6, 2017, 7:34pm UTC](https://discuss.elastic.co/t/how-to-make-an-own-timestamp-from-old-log-file/99543/2 "2017-09-06T19:34:34Z")

</div>

Without knowing what your logfile looks like we can't help.

---

<div class="post-metadata">

**Author:** ![Muhammad\_Rizky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muhammad_rizky/32/21839_2.png) [@Muhammad\_Rizky](https://discuss.elastic.co/u/Muhammad_Rizky)\
**Post date:** [September 8, 2017, 6:32am UTC](https://discuss.elastic.co/t/how-to-make-an-own-timestamp-from-old-log-file/99543/3 "2017-09-08T06:32:41Z")

</div>

2015 Mar 23 19:33:31:432 GMT +7 BW.FilePollerBW

for example like this sir

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 8, 2017, 7:18am UTC](https://discuss.elastic.co/t/how-to-make-an-own-timestamp-from-old-log-file/99543/4 "2017-09-08T07:18:16Z")

</div>

Your date pattern is wrong; you need MMM instead of MM. The part of the pattern used for the time probably also needs adjustments, but it depends on what your `my_timestamp` field looks like.

---

<div class="post-metadata">

**Author:** ![Muhammad\_Rizky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muhammad_rizky/32/21839_2.png) [@Muhammad\_Rizky](https://discuss.elastic.co/u/Muhammad_Rizky)\
**Post date:** [September 8, 2017, 8:43am UTC](https://discuss.elastic.co/t/how-to-make-an-own-timestamp-from-old-log-file/99543/5 "2017-09-08T08:43:52Z")

</div>

i've changed it into this sir

filter {  
grok {  
patterns\_dir =\> ["E:\ELK\patterns"]  
match =\> {  
"message" =\> "%{DATE\_YMD:my\_timestamp}"  
}  
}

```
date {
	match => ["my_timestamp", "yyyy MMM dd HH:mm:ss"]
	target => "my_timestamp"
}

```

}

but i got "\_dateparsefailure". Actually, all i want is to make "my\_timestamp" can read in elastic as date type, because i want to use it in timelion

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 8, 2017, 8:46am UTC](https://discuss.elastic.co/t/how-to-make-an-own-timestamp-from-old-log-file/99543/6 "2017-09-08T08:46:53Z")

</div>

As I said, the time part of your pattern probably needs adjustments too. I can't be specific since I don't know exactly what the `my_timestamp` field contains (because I don't know how you've defined the DATE\_YMD filter. When the date filter fails to parse a timestamp it'll tell you in the log what part of the string it had a problem with.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2017, 8:47am UTC](https://discuss.elastic.co/t/how-to-make-an-own-timestamp-from-old-log-file/99543/7 "2017-10-06T08:47:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.