# Logstash date extraction help

**URL:** <https://discuss.elastic.co/t/logstash-date-extraction-help/67010>\
**Category:** Logstash\
**Created:** [November 23, 2016, 4:35pm UTC](https://discuss.elastic.co/t/logstash-date-extraction-help/67010 "2016-11-23T16:35:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![FrankC](https://avatars.discourse-cdn.com/v4/letter/f/ed655f/32.png) [@FrankC](https://discuss.elastic.co/u/FrankC)\
**Post date:** [November 23, 2016, 4:35pm UTC](https://discuss.elastic.co/t/logstash-date-extraction-help/67010/1 "2016-11-23T16:35:52Z")

</div>

Hello,

I am stuck with logstash and need a little help. Each line starts with the event time stamp is multiline.

Message:

Tue Nov 01 00:07:24 2016  
Thread 1 advanced to log sequence 1234 (foo)  
Current log# 2 seq# 1234 mem# 0: log\_file\_path  
Current log# 2 seq# 1234 mem# 1: log\_file\_path  
Tue Nov 01 00:07:25 2016  
xyz: some data

Step 1: Im using this multiline codec in the input section to merge lines... this seems to work when looking at stdout

multiline {  
pattern =\> "%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}"  
negate =\> true  
what =\> "previous"  
}

Step 2: I want to extract the date & time and replace @timestamp with it.

I am stuck here. I know I need to use the date filter but I cannot get any pattern to work wit the date format.

Thanks,  
Frank

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 24, 2016, 8:54am UTC](https://discuss.elastic.co/t/logstash-date-extraction-help/67010/2 "2016-11-24T08:54:16Z")

</div>

What you have tried so far? The date filter logs any parsing errors. What does it say?

---

<div class="post-metadata">

**Author:** ![FrankC](https://avatars.discourse-cdn.com/v4/letter/f/ed655f/32.png) [@FrankC](https://discuss.elastic.co/u/FrankC)\
**Post date:** [November 28, 2016, 4:33am UTC](https://discuss.elastic.co/t/logstash-date-extraction-help/67010/3 "2016-11-28T04:33:09Z")

</div>

Hi,

After researching (mostly to learn GROK) it looks like this is working...

The log file always starts with a date (format: Tue Nov 01 00:00:00 2016)

grok {  
match =\> ["message", "^(?%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR})"]  
}

Now that I have the log time in the timestamp field I used the date match filter to replace the @timestamp field.

date {  
match =\> ["timestamp","E MMM dd HH:mm:ss yyyy"]  
timezone =\> "UTC"  
remove\_field =\> "timestamp"  
}

If there is an better way please let me know.

Regards,  
Frank

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2016, 4:33am UTC](https://discuss.elastic.co/t/logstash-date-extraction-help/67010/4 "2016-12-26T04:33:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.