### Author:  [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)
#### Post date: [May 30, 2018, 3:45pm UTC](https://discuss.elastic.co/t/issue-parsing-non-standard-timestamp-cisco-router-log/133908/1 "2018-05-30T15:45:31Z")
I am trying to parse logs from Cisco router with the following format:
`000022: Jan 02 15:42:11.048:%LINK-5-CHANGED: Interface Ethernet0, changed state to administratively down`
Notice the particular timestamp:
`Jan 02 15:42:11.048`
for which there is no prefedined grok pattern that contains the semantic **{MONTH} {MONTHDAY} and something like TIME with milliseconds**
I am using the following grok match:
```
filter {
grok {
match => {"message" => '%{INT:local_seq_num:int}: %{INT:src_seq_num:int}: (?): \%%{WORD:facility}\-%{WORD:severity}\-%{WORD:mnemonic}: %{GREEDYDATA:description}'}
}
}
```
The result is as expected except the timestamp, I don't know what to do with it:
How can I create a grok pattern that correctly parse the timestamp as such so it can be used in elasticsearch?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 30, 2018, 4:52pm UTC](https://discuss.elastic.co/t/issue-parsing-non-standard-timestamp-cisco-router-log/133908/2 "2018-05-30T16:52:31Z")
Using dissect instead of grok...
```
dissect { mapping => { "message" => "%{}: %{ts}:%{+ts}:%{+ts}:%{}" } }
date { match => ["ts", "MMM dd HH:mm:ss.SSS"] remove_field => ["ts"] }
```
You will probably need a [timezone](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-timezone) option on that date filter.
---
### Author:  [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)
#### Post date: [June 1, 2018, 2:56am UTC](https://discuss.elastic.co/t/issue-parsing-non-standard-timestamp-cisco-router-log/133908/3 "2018-06-01T02:56:53Z")
Hi @Badger, thanks for your reply.
I have learnt about dissect and the expression makes sens to me.
I have some questions:
- Why you remove the "ts" field at the end of date? Then where the parsed date is stored? In @timestamp?
- How to integrate it to the previous work? Should I remove the previous grok filter and redo everything in dissect? Or use them both with dissect for the time?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 1, 2018, 12:41pm UTC](https://discuss.elastic.co/t/issue-parsing-non-standard-timestamp-cisco-router-log/133908/4 "2018-06-01T12:41:51Z")
The remove\_field will happen if date successfully matches ts to that pattern. If it does not match it will not be removed. The date will be stored in @timestamp, and there is no need to keep ts if the parsed value has been stored.
It would make sense to completely replace grok with dissect, but then you need to add the rest of the fields to the dissect. The image you posted does not match the text of your post. For the image...
```
"<%{level}>:%{local_seq_num}: %{src_seq_num}: *%{ts} %{+ts} %{+ts} %{+ts} %{+ts}: %%{facility}-%{severity}-%{mnemonic}: %{description}"
```
---
### Author:  [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)
#### Post date: [June 22, 2018, 4:16pm UTC](https://discuss.elastic.co/t/issue-parsing-non-standard-timestamp-cisco-router-log/133908/5 "2018-06-22T16:16:57Z")
Thanks a lot @Badger, now it works fine.
I ended up with this formula:
```
dissect {
mapping => { "message" => "<%{local_seq_num}>%{src_seq_num}: *%{ts} %{+ts} %{+ts}:%{+ts}:%{+ts}.%{+ts}: %%{facility}-%{severity}-%{mnemonic}: %{description}"}
}
date {
match => ["ts", "MMM dd HH:mm:ss.SSS"] remove_field => ["ts"]
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 20, 2018, 4:26pm UTC](https://discuss.elastic.co/t/issue-parsing-non-standard-timestamp-cisco-router-log/133908/6 "2018-07-20T16:26:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.