# How to separate Date and time in HTTPDATE format in grok and assign in different fields

**URL:** <https://discuss.elastic.co/t/how-to-separate-date-and-time-in-httpdate-format-in-grok-and-assign-in-different-fields/169522>\
**Category:** Logstash\
**Created:** [February 22, 2019, 6:06am UTC](https://discuss.elastic.co/t/how-to-separate-date-and-time-in-httpdate-format-in-grok-and-assign-in-different-fields/169522 "2019-02-22T06:06:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nitin.jangid](https://avatars.discourse-cdn.com/v4/letter/n/919ad9/32.png) [@nitin.jangid](https://discuss.elastic.co/u/nitin.jangid)\
**Post date:** [February 22, 2019, 6:06am UTC](https://discuss.elastic.co/t/how-to-separate-date-and-time-in-httpdate-format-in-grok-and-assign-in-different-fields/169522/1 "2019-02-22T06:06:57Z")

</div>

Hi,

This is my weblogic log

> 10.10.110.180 - - [02/Jan/2018:12:36:37 +0530] "GET /imatch/cavsar/css/cavsar.css HTTP/1.1" 404 14681

with grok filter. I am having field name DateAndTime that having value 02/Jan/2018:12:36:37

> "message"=\>"%{IP:ServerIP} - - [%{HTTPDATE:DateAndTime}] &quot;%{WORD:ReqType} %{NOTSPACE:Url} %{WORD:Protocol}/%{NUMBER:Version}&quot; %{NUMBER:ResponseType} %{NUMBER:Duration:int}"

But i would like to have in elasticsearch two fields date and time separate so how can i filter this dateTime(HTTPDATE) format 02/Jan/2018:12:36:37 into two fields Date and time. Please help it would be appreciated.

Thanks In advance.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 22, 2019, 1:46pm UTC](https://discuss.elastic.co/t/how-to-separate-date-and-time-in-httpdate-format-in-grok-and-assign-in-different-fields/169522/2 "2019-02-22T13:46:28Z")

</div>

You could use [dissect](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html)

```
dissect {
    mapping => { "DateAndTime" => "%{date}:%{time}" }
    remove_field => ["DateAndTime"]
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 22, 2019, 1:46pm UTC](https://discuss.elastic.co/t/how-to-separate-date-and-time-in-httpdate-format-in-grok-and-assign-in-different-fields/169522/3 "2019-03-22T13:46:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.