# Log timestamp filed converting as time filter field

**URL:** <https://discuss.elastic.co/t/log-timestamp-filed-converting-as-time-filter-field/180609>\
**Category:** Logstash\
**Created:** [May 10, 2019, 6:24pm UTC](https://discuss.elastic.co/t/log-timestamp-filed-converting-as-time-filter-field/180609 "2019-05-10T18:24:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chandukreddi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chandukreddi/32/29241_2.png) [@chandukreddi](https://discuss.elastic.co/u/chandukreddi)\
**Post date:** [May 10, 2019, 6:24pm UTC](https://discuss.elastic.co/t/log-timestamp-filed-converting-as-time-filter-field/180609/1 "2019-05-10T18:24:33Z")

</div>

Hello Experts,

Need help to covert my log timestamp into time filter field.

I have log entry like below:

Mar 5 03:23:26 0-1 proxy-server: 127.0.0.1 127.0.0.1 05/Mar/2019/11/23/26 GET /v1/ACC\_1/.trash-01f2f42f-8cc0-45d2-a4ea-b8b117b0b659/0361543942741126%253A27a29814-dd8f-43ee-b768-19af98bf1d07%253A108/1543943058.64696 HTTP/1.0 200 - python-requests/2.5.1%20CPython/2.7.5%20Linux/3.10.0-327.36.3.el7.x86\_64 - - - - tx6b4c8afe9e2a4b8eb7073-005c7e5c2e - 0.0871 - - 1551785006.259215117 1551785006.346281052 0

Grok patterns used as below but no luck.

1. SYSLOGTIMESTAMP, this grok pattern working when I ran from Grok Debugger tool but in elasticsearch its showing as \_dateparsefailure  
 ![SYSLOGTIMESTAMP-grok](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a5126ddc7a9aad1ff9d90a6fc766dfa1b52a9ede.png)
2. %{MONTHDAY}[/]%{MONTH}[/]%{YEAR}[/]%{HOUR}[/]%{MINUTE}[/]%{SECOND} %{DATA} %{DATA}: I did manual way but still same problem  
 ![manul_grok](https://us1.discourse-cdn.com/elastic/original/3X/b/7/b70ba474a649eb81d146ed8f93fd5b1612ff6813.png)

here is my date filter from conf file:

date {  
match =\> ["logdate","MMM d HH:mm:ss"]  
target =\> "logdate"  
timezone =\> "PST8PDT"  
}

Thanks  
Chandra

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 10, 2019, 7:55pm UTC](https://discuss.elastic.co/t/log-timestamp-filed-converting-as-time-filter-field/180609/2 "2019-05-10T19:55:39Z")

</div>

For that first one the field is

```auto
Mar 4 15:59:53

```

with two spaces, so you could use

```
match => ["logdate", "MMM dd HH:mm:ss", "MMM d HH:mm:ss"]
```

---

<div class="post-metadata">

**Author:** ![chandukreddi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chandukreddi/32/29241_2.png) [@chandukreddi](https://discuss.elastic.co/u/chandukreddi)\
**Post date:** [May 10, 2019, 8:57pm UTC](https://discuss.elastic.co/t/log-timestamp-filed-converting-as-time-filter-field/180609/3 "2019-05-10T20:57:34Z")

</div>

Awesome @Badger, that was quick.. worked perfectly. I really appreciate your help.

Thanks  
Chandra

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2019, 9:11pm UTC](https://discuss.elastic.co/t/log-timestamp-filed-converting-as-time-filter-field/180609/4 "2019-06-07T21:11:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.