# How To use date Field in RAW data to used as @timestamp in Grok pattern **URL:** \ **Category:** Logstash\ **Created:** [April 2, 2019, 9:07am UTC](https://discuss.elastic.co/t/how-to-use-date-field-in-raw-data-to-used-as-timestamp-in-grok-pattern/174950 "2019-04-02T09:07:17Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Nabil\_Mohamed](https://avatars.discourse-cdn.com/v4/letter/n/35a633/32.png) [@Nabil\_Mohamed](https://discuss.elastic.co/u/Nabil_Mohamed)\ **Post date:** [April 2, 2019, 9:07am UTC](https://discuss.elastic.co/t/how-to-use-date-field-in-raw-data-to-used-as-timestamp-in-grok-pattern/174950/1 "2019-04-02T09:07:17Z")
Hi all , i need to use the date field in my Raw Data to used as the @timestamp in my index: RAW record data in the Filebeat --\> 20190402-000037,8120791274.50,7174800715.40,4.18,/run 11.00% / 77.00% /data 55.00% /boot 1.00% /home 32.00%,,0,30.16,30.16,6.12,13.01 Date field in FileBeat = "20190402-000037" Grok Pattern in logstash --\> filter { grok { match =\> { "message" =\> "%{DATA:DATE},%{NUMBER:used\_memory:float},%{NUMBER:free\_memory:float},%{NUMBER:CPU\_load:float},%{DATA:run} %{NUMBER:run\_usage:float}% %{DATA: root} %{NUMBER:root\_usage:float}% %{DATA:data} %{NUMBER:data\_usage:float}% %{DATA:boot} %{NUMBER:boot\_usage:float}% %{DATA:home} %{NUMBER:home\_usage:float}%,,%{NUMBER:MO\_SMS \_PER\_SEC:float},%{NUMBER:MT\_SMS\_PER\_SEC:float},%{NUMBER:Global\_sms\_per\_second:float},%{NUMBER:OTA\_PER\_SECOND:float},%{NUMBER:Hand\_set\_change\_per\_second:float}" } } -so i need my field in index "DATE" to be used as the @timestamp in my index , how can i do that ? thanks , ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 2, 2019, 1:17pm UTC](https://discuss.elastic.co/t/how-to-use-date-field-in-raw-data-to-used-as-timestamp-in-grok-pattern/174950/2 "2019-04-02T13:17:46Z")
> [@Nabil\_Mohamed](#): > > i need my field in index "DATE" to be used as the @timestamp in my index , how can i do that ? Use a date filter ``` date { match => ["DATE", "YYYYMMdd-HHmmss"] } ``` You may need to add the [timezone](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-timezone) option to that. ---
**Author:** ![Nabil\_Mohamed](https://avatars.discourse-cdn.com/v4/letter/n/35a633/32.png) [@Nabil\_Mohamed](https://discuss.elastic.co/u/Nabil_Mohamed)\ **Post date:** [April 3, 2019, 6:49am UTC](https://discuss.elastic.co/t/how-to-use-date-field-in-raw-data-to-used-as-timestamp-in-grok-pattern/174950/3 "2019-04-03T06:49:23Z")
thanks for reply , but i still have a problem. -actually the DATE field still "text" note "date" as below --\> "DATE" : { "type" : "text", "norms" : false, "fields" : { "keyword" : { "type" : "keyword", "ignore\_above" : 256 } } -while the only date field is timestamp field as below --\> "properties" : { "@timestamp" : { "type" : "date" }, -grok pattern after adding the "date" filter as below --\> filter { grok { match =\> { "message" =\> "%{DATA:DATE},%{NUMBER:used\_memory:float},%{NUMBER:free\_memory:float},%{NUMBER:CPU\_load:float},%{DATA:run} %{NUMBER:ru n\_usage:float}% %{DATA:root} %{NUMBER:root\_usage:float}% %{DATA:data} %{NUMBER:data\_usage:float}% %{DATA:boot} %{NUMBER:boot\_usage:float}% %{DATA:hom e} %{NUMBER:home\_usage:float}%,,%{NUMBER:MO\_SMS\_PER\_SEC:float},%{NUMBER:MT\_SMS\_PER\_SEC:float},%{NUMBER:Global\_sms\_per\_second:float},%{NUMBER:OTA\_PER\_SEC OND:float},%{NUMBER:Hand\_set\_change\_per\_second:float}" } } date { match =\> ["DATE", "YYYYMMdd-HHmmss"] } Note: when the RAW data record had yesterday date = "20190402-043536" and using the above grok , the index not created. however when i use the current data of today = "20190403-043536" , the index was created. and i don't know the reason. -still need some suggestions to solve the issue for this field and use it as my "timestamp" in my index . ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 3, 2019, 1:15pm UTC](https://discuss.elastic.co/t/how-to-use-date-field-in-raw-data-to-used-as-timestamp-in-grok-pattern/174950/4 "2019-04-03T13:15:21Z")
That's working as expected. If you want to overwrite DATE with the parsed value then set the [target](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-target) option on the date filter. ---
**Author:** ![Nabil\_Mohamed](https://avatars.discourse-cdn.com/v4/letter/n/35a633/32.png) [@Nabil\_Mohamed](https://discuss.elastic.co/u/Nabil_Mohamed)\ **Post date:** [April 3, 2019, 1:48pm UTC](https://discuss.elastic.co/t/how-to-use-date-field-in-raw-data-to-used-as-timestamp-in-grok-pattern/174950/5 "2019-04-03T13:48:37Z")
do you mean to be like this --\> date { match =\> ["DATE", "YYYYMMdd-HHmmss"] target =\> "DATE" } ? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 3, 2019, 1:49pm UTC](https://discuss.elastic.co/t/how-to-use-date-field-in-raw-data-to-used-as-timestamp-in-grok-pattern/174950/6 "2019-04-03T13:49:41Z")
Yes. ---
**Author:** ![Nabil\_Mohamed](https://avatars.discourse-cdn.com/v4/letter/n/35a633/32.png) [@Nabil\_Mohamed](https://discuss.elastic.co/u/Nabil_Mohamed)\ **Post date:** [April 3, 2019, 7:11pm UTC](https://discuss.elastic.co/t/how-to-use-date-field-in-raw-data-to-used-as-timestamp-in-grok-pattern/174950/7 "2019-04-03T19:11:59Z")
perfect !! it is working now. thanks for your support and help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 1, 2019, 7:17pm UTC](https://discuss.elastic.co/t/how-to-use-date-field-in-raw-data-to-used-as-timestamp-in-grok-pattern/174950/8 "2019-05-01T19:17:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.