# Is there a way to match Timestamps with the time in the message of the log **URL:** \ **Category:** Logstash\ **Created:** [July 28, 2020, 12:33pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-match-timestamps-with-the-time-in-the-message-of-the-log/242906 "2020-07-28T12:33:21Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Archie\_Crawford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/archie_crawford/32/62732_2.png) [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\ **Post date:** [July 28, 2020, 12:33pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-match-timestamps-with-the-time-in-the-message-of-the-log/242906/1 "2020-07-28T12:33:21Z")
I have tried to use things like : Filter{ grok { match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp}"] } date { match =\> ["timestamp", "ISO8601"] } } I have been trying to do this for java stack trace logs ... and I have not been able to get it to work ![message log to timmestamp](https://us1.discourse-cdn.com/elastic/original/3X/0/0/00c9ce5dec3641d740e6fbb4d125c113413b1847.png) ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [July 28, 2020, 12:43pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-match-timestamps-with-the-time-in-the-message-of-the-log/242906/2 "2020-07-28T12:43:44Z")
That's not ISO8601. It's a `SYSLOGTIMESTAMP` with the format `MMM dd HH:mm:ss`. ---
**Author:** ![Archie\_Crawford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/archie_crawford/32/62732_2.png) [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\ **Post date:** [July 28, 2020, 5:26pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-match-timestamps-with-the-time-in-the-message-of-the-log/242906/3 "2020-07-28T17:26:30Z")
Ok I switched that out, and I can get a new field that shows the time in @timestamp, but the Time in the far left still does not change ... the one that shows when it was sent to the index ![Time change](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5d3fae4166b88518d5d004868cf3dfdcd64d934b.png) ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [July 28, 2020, 5:31pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-match-timestamps-with-the-time-in-the-message-of-the-log/242906/4 "2020-07-28T17:31:30Z")
What does your configuration look like And how many different date formats are there? The second screenshot seems to have a completely different message format than the first? Having some example events posted as text instead of pictures might make it clearer. ---
**Author:** ![Archie\_Crawford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/archie_crawford/32/62732_2.png) [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\ **Post date:** [July 28, 2020, 6:18pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-match-timestamps-with-the-time-in-the-message-of-the-log/242906/5 "2020-07-28T18:18:08Z")
Sorry about that, I have different log paths going to the kibana the first one was a /var/log/message and the second one came from acess.80.log log path... ill upload the logs ---
**Author:** ![Archie\_Crawford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/archie_crawford/32/62732_2.png) [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\ **Post date:** [July 29, 2020, 5:49pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-match-timestamps-with-the-time-in-the-message-of-the-log/242906/6 "2020-07-29T17:49:01Z")
```auto filter { grok { match => ["message", "%{TIMESTAMP_ISO8601:timestamp}%{GREEDYDATA:Message}"] } date { match => ["timestamp", "ISO8601"] } } ``` I went back to this conf in logstash because I notice it matches the catalina logs.. the screen show is the logs filtered for just the catlinia logs ![Timestamp](https://us1.discourse-cdn.com/elastic/original/3X/b/d/bd40ba436766739871a351de099cc9e215490f6b.png) ---
**Author:** ![Archie\_Crawford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/archie_crawford/32/62732_2.png) [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\ **Post date:** [July 29, 2020, 5:49pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-match-timestamps-with-the-time-in-the-message-of-the-log/242906/7 "2020-07-29T17:49:54Z")
When you say post event in text instead of pic im not sure what you mean ---
**Author:** ![Archie\_Crawford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/archie_crawford/32/62732_2.png) [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\ **Post date:** [July 29, 2020, 5:52pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-match-timestamps-with-the-time-in-the-message-of-the-log/242906/8 "2020-07-29T17:52:54Z")
You know what ... after doing this again... its now working ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 29, 2020, 6:58pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-match-timestamps-with-the-time-in-the-message-of-the-log/242906/9 "2020-07-29T18:58:58Z")
If you post a screen shot of an event in Kibana the screen shot is not searchable. It is not accessible to the visually impaired. I cannot copy and paste the message field to a machine running logstash, so that I can actually try things and give you a working solution. Instead I can make suggestions about what you can try. Help us to help you. Instead of posting a screenshot, expand the event in Discover and click on the JSON tab, then copy and paste the JSON. Redact as necessary, without changing the structure. Select the JSON in the edit pane and click on \ in the toolbar above the edit pane, so that the formatting of the JSON is preserved. ---
**Author:** ![Archie\_Crawford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/archie_crawford/32/62732_2.png) [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\ **Post date:** [July 29, 2020, 7:32pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-match-timestamps-with-the-time-in-the-message-of-the-log/242906/10 "2020-07-29T19:32:29Z")
Ahh ok I see , thank you ... and it is working now ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 26, 2020, 7:32pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-match-timestamps-with-the-time-in-the-message-of-the-log/242906/11 "2020-08-26T19:32:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.