# Log file without Year

**URL:** https://discuss.elastic.co/t/log-file-without-year/80222
**Category:** Logstash
**Created:** [March 28, 2017, 2:20am UTC](https://discuss.elastic.co/t/log-file-without-year/80222 "2017-03-28T02:20:54Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![chic\_cat](https://avatars.discourse-cdn.com/v4/letter/c/e99b99/32.png) [@chic\_cat](https://discuss.elastic.co/u/chic_cat)
#### Post date: [March 28, 2017, 2:20am UTC](https://discuss.elastic.co/t/log-file-without-year/80222/1 "2017-03-28T02:20:54Z")

</div>

Hi guys, I have logs in format:  
Mar 23 11:54:35 server [Controller] [Thread-530] ERROR Connection error

I tried to use next filter, but it doesn't work,

filter {  
if [type] == "data" {

```
grok {
  match => {
    "message" => [
      "^%{TIMESTAMP_ISO8601:timestamp} %{GREEDYDATA}$"
    ]
  }
}

date {
  match => ["timestamp", "MMM dd HH:mm:ss"]
}

```

}  
}

Any one had similar issues?

Thanks

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 28, 2017, 5:32am UTC](https://discuss.elastic.co/t/log-file-without-year/80222/2 "2017-03-28T05:32:11Z")

</div>

The TIMESTAMP\_ISO8601 pattern is for ISO8601 dates but your date is in another format. Since your log appears to be from syslog, why not use a syslog pattern?

[https://www.elastic.co/guide/en/logstash/current/config-examples.html#\_processing\_syslog\_messages](https://www.elastic.co/guide/en/logstash/current/config-examples.html#_processing_syslog_messages)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 28, 2017, 4:47am UTC](https://discuss.elastic.co/t/log-file-without-year/80222/4 "2017-04-28T04:47:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.