# How to read JSON file using logstash and convert String date format to Date time format

**URL:** <https://discuss.elastic.co/t/how-to-read-json-file-using-logstash-and-convert-string-date-format-to-date-time-format/103561>\
**Category:** Logstash\
**Created:** [October 11, 2017, 1:49pm UTC](https://discuss.elastic.co/t/how-to-read-json-file-using-logstash-and-convert-string-date-format-to-date-time-format/103561 "2017-10-11T13:49:13Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vignesh\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vignesh_kumar/32/41866_2.png) [@Vignesh\_Kumar](https://discuss.elastic.co/u/Vignesh_Kumar)\
**Post date:** [October 11, 2017, 1:49pm UTC](https://discuss.elastic.co/t/how-to-read-json-file-using-logstash-and-convert-string-date-format-to-date-time-format/103561/1 "2017-10-11T13:49:13Z")

</div>

The Input is like json, Need to get this **"TimeStamp": "20170926110036"**

{  
"Properties": {  
"Client Name": "Chubb",  
"Portfolio": "Chubb-Transfer"  
},  
"Capture": [  
{  
"CaptureGUID": "caa1f5ba-1e93-4926-b3ac-e30d0d9d4cbb",  
"HTMLPath": "Captures\C:\",  
"ScreenName": "Amdocs CRM - ClearCallCenter - [Console]",  
"TimeStamp": "20170926110036"  
}  
]  
}

My Logstash config is as below,  
input {  
file {  
type =\> "json"  
path =\> "C:/ELK/data/Recordings/\*.json"  
start\_position =\> beginning  
codec =\> multiline {  
pattern =\> "^{"  
negate =\> "true"  
what =\> "previous"  
max\_lines =\> 30000  
}  
}  
}  
filter{  
date {  
match =\> ["TimeStamp", "yyyyMMddHHmmss"]  
target =\> "TimeStamp"  
}

```
mutate { 
replace => { "message" => "%{message}}" }
gsub => ['message','\n','']
}

json { 
source => "message" 
remove_field => ["message"]
}

```

}

output {  
elasticsearch {  
index =\> "test10"  
}  
stdout { codec =\> rubydebug }  
}

But output of the date format is in string format only it is not changing to date time format.  
"Properties" =\> {"Client Name"=\> "Chubb", "Portfolio"=\> "Chubb-Transfer" }, "Capture" =\> [{ "CaptureGUID"=\> "caa1f5ba-1e93-4926-b3ac-e30d0d9d4cbb", "HTMLPath"=\> "Captures\C:\", "ScreenName"=\> docs CRM - ClearCallCenter - [Console]", "TimeStamp"=\> 20170926110036"}]

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 11, 2017, 4:21pm UTC](https://discuss.elastic.co/t/how-to-read-json-file-using-logstash-and-convert-string-date-format-to-date-time-format/103561/2 "2017-10-11T16:21:46Z")

</div>

You have nested fields, so the actual name of your timestamp field is `[Capture][0][TimeStamp]`.

---

<div class="post-metadata">

**Author:** ![Vignesh\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vignesh_kumar/32/41866_2.png) [@Vignesh\_Kumar](https://discuss.elastic.co/u/Vignesh_Kumar)\
**Post date:** [October 12, 2017, 4:40am UTC](https://discuss.elastic.co/t/how-to-read-json-file-using-logstash-and-convert-string-date-format-to-date-time-format/103561/3 "2017-10-12T04:40:10Z")

</div>

Thank you. Please let me know, how to match this in the date filter,  
date {  
match =\> ["[Capture][0][TimeStamp]", "yyyyMMddHHmmss"]  
target =\> "TimeStamp"  
}  
I tried give above the also it is not detecting.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 12, 2017, 5:14am UTC](https://discuss.elastic.co/t/how-to-read-json-file-using-logstash-and-convert-string-date-format-to-date-time-format/103561/4 "2017-10-12T05:14:54Z")

</div>

Please show the resulting event. Use a `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

**Author:** ![Vignesh\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vignesh_kumar/32/41866_2.png) [@Vignesh\_Kumar](https://discuss.elastic.co/u/Vignesh_Kumar)\
**Post date:** [October 12, 2017, 6:07am UTC](https://discuss.elastic.co/t/how-to-read-json-file-using-logstash-and-convert-string-date-format-to-date-time-format/103561/5 "2017-10-12T06:07:15Z")

</div>

> [@magnusbaeck](#):
>
> stdout { codec =\> rubydebug }

The resulting is same,  
{  
"Properties" =\>  
{"Client Name"=\> "Chubb", "Portfolio"=\> "Chubb-Transfer" },  
"Capture" =\>  
[  
{  
"CaptureGUID"=\> "caa1f5ba-1e93-4926-b3ac-e30d0d9d4cbb",  
"HTMLPath"=\> "Captures\C:",  
"ScreenName"=\> "docs CRM - ClearCallCenter - [Console]",  
"TimeStamp"=\> "20170926110036"  
}  
]  
}

it is showing the TimeStamp still in string format only.

---

<div class="post-metadata">

**Author:** ![Vignesh\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vignesh_kumar/32/41866_2.png) [@Vignesh\_Kumar](https://discuss.elastic.co/u/Vignesh_Kumar)\
**Post date:** [October 12, 2017, 6:33am UTC](https://discuss.elastic.co/t/how-to-read-json-file-using-logstash-and-convert-string-date-format-to-date-time-format/103561/6 "2017-10-12T06:33:20Z")

</div>

Thanks for the reply it worked  
date {  
match =\> ["[Capture][TimeStamp]", "yyyyMMddHHmmss"]  
add\_tag =\> "edirtime"  
target =\> "@timestamp"  
timezone =\> "Asia/Kolkata"  
locale =\> "en"  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2017, 6:33am UTC](https://discuss.elastic.co/t/how-to-read-json-file-using-logstash-and-convert-string-date-format-to-date-time-format/103561/7 "2017-11-09T06:33:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.