# Index datetime from log file instead of auto datetime
**URL:** https://discuss.elastic.co/t/index-datetime-from-log-file-instead-of-auto-datetime/127296
**Category:** Logstash
**Created:** [April 9, 2018, 9:52am UTC](https://discuss.elastic.co/t/index-datetime-from-log-file-instead-of-auto-datetime/127296 "2018-04-09T09:52:39Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@commonman.net](https://discuss.elastic.co/u/commonman.net)
#### Post date: [April 9, 2018, 9:52am UTC](https://discuss.elastic.co/t/index-datetime-from-log-file-instead-of-auto-datetime/127296/1 "2018-04-09T09:52:39Z")
Hi Team,
I'm trying to load log data into Elasticsearch through Logstash. My log file is back dated. however, date is not indexed from log file. How to use log file date for searching.. Highly appreciated your response. Thanks
Input data sample:
31/10/2017 6:21:04 PM : Test 1
31/10/2017 6:21:05 PM : Test 2
31/10/2017 6:21:06 PM : Test 3
Logstash Pipeline
input {
file {
path =\> "C:\Technology\SampleData\input\log.txt"
start\_position =\> "beginning"
}
}
filter {
grok {
match =\> { "message" =\> "%{DATESTAMP:LogDate} %{GREEDYDATA}" }
}
date {
match =\> ["timestamp" , "dd/MM/yyyy:HH:mm:ss Z"]
target =\> ["@timestamp"]
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> ["textdata"]
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 9, 2018, 10:22am UTC](https://discuss.elastic.co/t/index-datetime-from-log-file-instead-of-auto-datetime/127296/2 "2018-04-09T10:22:05Z")
Please copy/paste a complete message in Kibana (expand one of the lines and copy/paste the JSON document from the JSON tab).
---
### Author:  [@commonman.net](https://discuss.elastic.co/u/commonman.net)
#### Post date: [April 9, 2018, 10:32am UTC](https://discuss.elastic.co/t/index-datetime-from-log-file-instead-of-auto-datetime/127296/3 "2018-04-09T10:32:50Z")
Hi Magnus Back,
Thanks for your response. As mentioned, please find the details below
{
"\_index": "textdata",
"\_type": "logs",
"\_id": "AWKpwND6rvMhbdXhRSBV",
"\_version": 1,
"\_score": null,
"\_source": {
"@version": "1",
"host": "DESKTOP-D4PSC86",
"path": "C:\Technology\SampleData\input\log.txt",
"@timestamp": "2018-04-09T09:33:28.251Z",
"message": "31/10/2017 6:21:04 PM : Test 1\r",
"LogDate": "31/10/2017 6:21:04"
},
"fields": {
"@timestamp": [
1523266408251
]
},
"sort": [
1523266408251
]
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 9, 2018, 11:15am UTC](https://discuss.elastic.co/t/index-datetime-from-log-file-instead-of-auto-datetime/127296/4 "2018-04-09T11:15:21Z")
You have configured your date filter to parse a `timestamp` field but the name of your field is actually `LogDate`. Secondly the pattern isn't quite right; your timestamp has no colon between the date and the time and it doesn't end with a timezone offset.
---
### Author:  [@commonman.net](https://discuss.elastic.co/u/commonman.net)
#### Post date: [April 10, 2018, 4:19am UTC](https://discuss.elastic.co/t/index-datetime-from-log-file-instead-of-auto-datetime/127296/5 "2018-04-10T04:19:11Z")
Hi Magnus,
Excellent. Thanks for the indicating right to the point. It's fine now. I have two queries
1. I want to split the message line into fields. currently all in one line
Ex, "message": "03/04/2018 13:44:54 Number of rows read:10\r"
2. How do I parse if some lines in the file does not have datetime. (it's different format)
Thanks in advance
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 10, 2018, 5:58am UTC](https://discuss.elastic.co/t/index-datetime-from-log-file-instead-of-auto-datetime/127296/6 "2018-04-10T05:58:55Z")
1. Just extend your grok filter.
2. Your grok filter can list multiple expressions that will get tried in order until there's a match. There's an example of this in the grok filter documentation.
---
### Author:  [@commonman.net](https://discuss.elastic.co/u/commonman.net)
#### Post date: [April 12, 2018, 2:43am UTC](https://discuss.elastic.co/t/index-datetime-from-log-file-instead-of-auto-datetime/127296/7 "2018-04-12T02:43:46Z")
Thank you Magnus..
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 10, 2018, 2:43am UTC](https://discuss.elastic.co/t/index-datetime-from-log-file-instead-of-auto-datetime/127296/8 "2018-05-10T02:43:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.