# Logstash : convert date to unix time problem
**URL:** https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711
**Category:** Logstash
**Created:** [November 22, 2017, 12:12pm UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711 "2017-11-22T12:12:41Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@linsie](https://discuss.elastic.co/u/linsie)
#### Post date: [November 22, 2017, 12:12pm UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/1 "2017-11-22T12:12:42Z")
logstash verison : 5.0.1
i want to convert the time : 20171122194855.000000480 to unix time
how can i do in logstash filter ? thanks so much.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 22, 2017, 12:25pm UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/2 "2017-11-22T12:25:10Z")
You can use a date filter to parse the string into a timestamp object. Then you should be able to use a piece of Ruby in a ruby filter to convert the timestamp object into an epoch integer.
---
### Author:  [@ericohtake](https://discuss.elastic.co/u/ericohtake)
#### Post date: [November 22, 2017, 12:32pm UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/3 "2017-11-22T12:32:41Z")
I just had the almost same requirement besides converting into Unix time. The method below converts a very similar data to a timestamp that can be picked up by Logstash:
Data:
> `20171031235935785`
Filter:
```
date {
match => ["SOURCE_FIELD", "YYYYMMddHHmmssSSS"]
}
```
Maybe this can give you some ideas.
---
### Author:  [@linsie](https://discuss.elastic.co/u/linsie)
#### Post date: [November 23, 2017, 1:57am UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/4 "2017-11-23T01:57:40Z")
> [@linsie](#):
>
> 20171122194855.000000480 to
Hi ericohtake,
Thx your reply. I have a try , but not successful.
My source log :
Source=Service Control Manager Category=0 RecordNumber=29488 Message=The WinHTTP. Event=7036 Type=Information TimeGenerated=20171121174525.000000480 Computer=computer\_PC LogFile=System
logstash filter file:
filter{
grok {
match =\> {"message" =\> "Source=%{GREEDYDATA:Source} Category=%{NUMBER:Category} RecordNumber=%{NUMBER:RecordNumber} Message=%{GREEDYDATA:msg} Event=%{NUMBER:eventId} CategoryString=%{GREEDYDATA:CategoryString} Type=%{GREEDYDATA:Type} TimeGenerated=%{NUMBER:time:int} Computer=%{WORD:shost} LogFile=%{GREEDYDATA:LogFile}"}
remove\_field =\> ["message","host", "@version"]
}
date{
match =\> ["time", "YYYYMMddHHmmss"]
target =\> "logdate"
}
ruby{
code =\>"
event['logunixtime'] = event['logdate'].to\_i
"}
}
The error information:
Failed parsing date from field {:field=\>"time", :value=\>20171123091554, :exception=\>"could not coerce Fixnum to class java.lang.String", :config\_parsers=\>"YYYYMMddHHmmss", :config\_locale=\>"default=en\_US"}
what's my problem ? is that my grok " TimeGenerated=%{NUMBER:time:int} " not right ???
How can I write this?
---
### Author:  [@linsie](https://discuss.elastic.co/u/linsie)
#### Post date: [November 23, 2017, 2:03am UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/5 "2017-11-23T02:03:33Z")
Hi magnusbaeck,
I have tried, but not successful.
logstash filter file:
filter{
grok {
match =\> {"message" =\> "Source=%{GREEDYDATA:Source} Category=%{NUMBER:Category} RecordNumber=%{NUMBER:RecordNumber} Message=%{GREEDYDATA:msg} Event=%{NUMBER:eventId} CategoryString=%{GREEDYDATA:CategoryString} Type=%{GREEDYDATA:Type} TimeGenerated=%{NUMBER:time:int} Computer=%{WORD:shost} LogFile=%{GREEDYDATA:LogFile}"}
remove\_field =\> ["message","host", "@version"]
}
date{
match =\> ["time", "YYYYMMddHHmmss"]
target =\> "logdate"
}
ruby{
code =\>"
event['logunixtime'] = event['logdate'].to\_i
"}
}
So what's my problem ? Thank you so much!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 23, 2017, 6:34am UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/6 "2017-11-23T06:34:04Z")
> what's my problem ? is that my grok " TimeGenerated=%{NUMBER:time:int} " not right ???
Drop `:int`. In this case you don't want the matched string to be converted to an integer.
Unrelated to your problem but I'm mentioning it anyway: For performance (and in some cases correctness) reasons you don't want to have more than one DATA or GREEDYDATA pattern in a file. In this particular case you can just use a kv filter and skip the grok filter.
---
### Author:  [@linsie](https://discuss.elastic.co/u/linsie)
#### Post date: [November 23, 2017, 7:21am UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/7 "2017-11-23T07:21:53Z")
Thanks your remind！
I have dropped : int but it still "\_dateparsefailure"
error information :
: exception =\> " could not coerce Fixnum to class java.lang.String"
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 23, 2017, 7:37am UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/8 "2017-11-23T07:37:22Z")
Please show an example event produced by Logstash. Use a `stdout { codec => rubydebug }` output.
---
### Author:  [@linsie](https://discuss.elastic.co/u/linsie)
#### Post date: [November 23, 2017, 9:36am UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/9 "2017-11-23T09:36:25Z")
I adjust the filter file :
filter{
grok {
match =\> {"message" =\> "Source=%{GREEDYDATA:Source} Category=%{NUMBER:Category} RecordNumber=%{NUMBER:RecordNumber} Message=%{GREEDYDATA:msg} Event=%{NUMBER:eventId} CategoryString=%{GREEDYDATA:CategoryString} Type=%{GREEDYDATA:Type} TimeGenerated=%{NUMBER:time} Computer=%{WORD:shost} LogFile=%{GREEDYDATA:LogFile}"}
remove\_field =\> ["message","host", "@version"]
}
```
mutate {
convert => {"time", "int"}
```
}
mutate {
convert =\> {"time", "string"}
}
date{
match =\> ["time", "YYYYMMddHHmmss"]
target =\> "logdate"
}
ruby{
code =\>"
event['logunixtime'] = event['logdate'].to\_i
"}
}
so it worked. Next I will try to use a kv filter and not use grok filter. thanks for your points
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 23, 2017, 9:37am UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/10 "2017-11-23T09:37:41Z")
Remove the two mutate filters. There's no point in converting the field value back and forth.
---
### Author:  [@linsie](https://discuss.elastic.co/u/linsie)
#### Post date: [November 23, 2017, 9:57am UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/11 "2017-11-23T09:57:53Z")
Yes, yes, and it also worked. and filter file changed.
date{
match =\> ["time", "YYYYMMddHHmmss.SSSSSSSSS"]
target =\> "logdate"
}
---
### Author:  [@ericohtake](https://discuss.elastic.co/u/ericohtake)
#### Post date: [November 24, 2017, 5:42am UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/12 "2017-11-24T05:42:43Z")
> [@magnusbaeck](#):
>
> For performance (and in some cases correctness) reasons you don't want to have more than one DATA or GREEDYDATA pattern in a file. In this particular case you can just use a kv filter and skip the grok filter.
This is a very valuable tip. Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 22, 2017, 5:42am UTC](https://discuss.elastic.co/t/logstash-convert-date-to-unix-time-problem/108711/13 "2017-12-22T05:42:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.