# How to parse date field into @timestamp
**URL:** https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849
**Category:** Logstash
**Created:** [December 22, 2023, 9:59am UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849 "2023-12-22T09:59:23Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@emoxam](https://discuss.elastic.co/u/emoxam)
#### Post date: [December 22, 2023, 9:59am UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/1 "2023-12-22T09:59:23Z")
I want to move the fulltime from message field to @timestamp. That's what i created.
```auto
filter {
if [message] =~ /actions/ {
json {
source => "message"
}
date {
match => ["message", "yyyy-MM-dd HH:mm:ss,SSS"]
target => "@timestamp"
add_field => { "debug" => "timestampMatched" }
}
}
}
```
I see at logstash logs
```auto
jsonlines - JSON parse error, original data now in message field
{:message=>"Unexpected character ('-' (code 45)): Expected space separating root-level values\n at [Source: (String)\"2023-12-22 09:41:56,343
```
and at kibana i see
`tags _jsonparsefailure`
What am i doing wrong ?
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [December 22, 2023, 10:12am UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/2 "2023-12-22T10:12:28Z")
What is the content of the "message" field?
- _if [message] =~ /actions/ {_ \<-- this means it contains something else except date part as string
- _json { source =\> "message"_ \<-- no target set. DocL: Define the target field for placing the parsed data. If this setting is omitted, the JSON data will be stored at the root (top level) of the event.
- _date { match =\> [ "message"_ \<-- are you sure that this is correct field.
- _tags \_jsonparsefailure_ \<-- your json conversion was failed because it contains "Unexpected character ('-'
---
### Author:  [@emoxam](https://discuss.elastic.co/u/emoxam)
#### Post date: [December 22, 2023, 10:41am UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/3 "2023-12-22T10:41:27Z")
"message" is an java application log.
Here's an example, i hope it can be useful.
_if [message] =~ /actions/ {_ \<-- here i try to select all logs that contains 'actions'.
Then i try to put the date at @timestamp using the examples i found at google...
---
### Author:  [@emoxam](https://discuss.elastic.co/u/emoxam)
#### Post date: [December 22, 2023, 10:43am UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/4 "2023-12-22T10:43:51Z")
Logtime of app and logtime of ELK is differs, it makes debugging harder, that's why i want to make logtime the same.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [December 22, 2023, 10:52am UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/5 "2023-12-22T10:52:55Z")
This is not JSON object. You should use grok or dissect plugins and parse the message.
Please to not put pictures, only text.
---
### Author:  [@emoxam](https://discuss.elastic.co/u/emoxam)
#### Post date: [December 22, 2023, 11:27am UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/6 "2023-12-22T11:27:03Z")
```auto
input {
tcp {
port => 5000
codec => plain
}
}
```
and
```auto
filter {
if [message] =~ /actions/ {
grok {
match => { "timestamp" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND},%{INT:milliseconds}" }
target => "@timestamp"
add_field => { "debug" => "timestampMatched" }
}
}
}
```
Thats right ?
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [December 22, 2023, 11:39am UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/7 "2023-12-22T11:39:52Z")
It's easier with TIMESTAMP\_ISO8601, something like this
`%{TIMESTAMP_ISO8601:time}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}\[%{WORD:action},%{DATA:something1}%{DATA:something2},\]%{SPACE}%{INT:num}%{SPACE}`
for the line like this:
_2023-12-22 13:17:10.222 INFO [actions,,] 7 ---_
[Note: this is not full line, too lazy]
Also then you can use:
`if [action] == "actions" { ...`
---
### Author:  [@emoxam](https://discuss.elastic.co/u/emoxam)
#### Post date: [December 22, 2023, 11:43am UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/9 "2023-12-22T11:43:25Z")
I've read TIMESTAMP\_ISO8601 has T instead of space, so it's no good for my case.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [December 22, 2023, 11:52am UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/10 "2023-12-22T11:52:26Z")
`TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?`
[T] - T or space
And grok is working
---
### Author:  [@emoxam](https://discuss.elastic.co/u/emoxam)
#### Post date: [December 22, 2023, 12:10pm UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/11 "2023-12-22T12:10:40Z")
> [@Rios](#):
>
> %{TIMESTAMP\_ISO8601:time}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}[%{WORD:action},%{DATA:something1}%{DATA:something2},]%{SPACE}%{INT:num}%{SPACE}
Ok
I want to fields by grok
"timestamp" and "the rest"
what grok pattern will it be ?
---
### Author:  [@emoxam](https://discuss.elastic.co/u/emoxam)
#### Post date: [December 22, 2023, 12:50pm UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/12 "2023-12-22T12:50:35Z")
```auto
"event" => {
Dec 22 15:48:10 elastic-search logstash[877610]: "original" => "2023-12-22 15:48:10,373 INFO [scheduling-1] actions.scheduler.DeviceQueueExecutor - =========== runner finish ==========="
Dec 22 15:48:10 elastic-search logstash[877610]: },
Dec 22 15:48:10 elastic-search logstash[877610]: "message" => "2023-12-22 15:48:10,373 INFO [scheduling-1] actions.scheduler.DeviceQueueExecutor
- =========== runner finish ===========",
Dec 22 15:48:10 elastic-search logstash[877610]: "@timestamp" => 2023-12-22T12:48:10.374750156Z,
Dec 22 15:48:10 elastic-search logstash[877610]: "@version" => "1",
Dec 22 15:48:10 elastic-search logstash[877610]: "tags" => [
Dec 22 15:48:10 elastic-search logstash[877610]: [0] "_grokparsefailure"
Dec 22 15:48:10 elastic-search logstash[877610]: ]
Dec 22 15:48:10 elastic-search logstash[877610]: }
```
with this config
```auto
filter {
if [message] =~ /actions/ {
grok {
match => { "timestamp" => "%{TIMESTAMP_ISO8601}" }
target => "@timestamp"
add_field => { "debug" => "timestampMatched" }
}
}
}
```
What's wrong ?
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [December 22, 2023, 2:26pm UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/13 "2023-12-22T14:26:55Z")
For that type log,use the filter like this:
```auto
input {
generator {
message => "2023-12-22 15:48:10,373 INFO [scheduling-1] actions.scheduler.DeviceQueueExecutor - =========== runner finish ==========="
count => 1
}
}
filter {
grok {
match => { "message" => "^%{TIMESTAMP_ISO8601:time}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}\[%{DATA:class}\]%{SPACE}%{DATA:method}\s+%{GREEDYDATA:msg}" }
}
date {
match => ["time", "yyyy-MM-dd HH:mm:ss,SSS"]
target=> "@timestamp"
}
}
output {
stdout { codec => rubydebug{} }
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 24, 2024, 7:22am UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/349849/15 "2024-01-24T07:22:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.