# Logstash - Dateformat yyyyMMdd HHmmss

**URL:** <https://discuss.elastic.co/t/logstash-dateformat-yyyymmdd-hhmmss/324311>\
**Category:** Logstash\
**Created:** [January 31, 2023, 10:00am UTC](https://discuss.elastic.co/t/logstash-dateformat-yyyymmdd-hhmmss/324311 "2023-01-31T10:00:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![A.Klos](https://avatars.discourse-cdn.com/v4/letter/a/977dab/32.png) [@A.Klos](https://discuss.elastic.co/u/A.Klos)\
**Post date:** [January 31, 2023, 10:00am UTC](https://discuss.elastic.co/t/logstash-dateformat-yyyymmdd-hhmmss/324311/1 "2023-01-31T10:00:28Z")

</div>

Hi,

I have still problem to get right timestamp in elastic.

One Row of log looks like:

20210611 111146 SOME Date Field ...

I tried:

```
 grok {
            match => ["message" , "%{DATA:timestamp}"]
    }
  date {
   match => ["timestamp","yyyyMMdd HHmmss"]
   timezone => ["Europe/Berlin"]
   target => "@timestamp"
  }

```

}

Still no chance to get right date format into timestamp

any ideas?

Regards

Axel

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 31, 2023, 1:33pm UTC](https://discuss.elastic.co/t/logstash-dateformat-yyyymmdd-hhmmss/324311/2 "2023-01-31T13:33:39Z")

</div>

Try custom date format, similar to DATESTAMP\_EVENTLOG

```auto
    grok {
     match => { "message" => ["%{DATELOG:timestamp} %{GREEDYDATA}"] }
     pattern_definitions => { "DATELOG" => "%{YEAR}%{MONTHNUM2}%{MONTHDAY} %{HOUR}%{MINUTE}%{SECOND}}" } 
    }

```

---

<div class="post-metadata">

**Author:** ![A.Klos](https://avatars.discourse-cdn.com/v4/letter/a/977dab/32.png) [@A.Klos](https://discuss.elastic.co/u/A.Klos)\
**Post date:** [February 3, 2023, 1:45pm UTC](https://discuss.elastic.co/t/logstash-dateformat-yyyymmdd-hhmmss/324311/3 "2023-02-03T13:45:05Z")

</div>

> [@Rios](#):
>
> ```auto
> grok {
> match => { "message" => ["%{DATELOG:timestamp} %{GREEDYDATA}"] }
> pattern_definitions => { "DATELOG" => "%{YEAR}%{MONTHNUM2}%{MONTHDAY} %{HOUR}%{MINUTE}%{SECOND}}" } 
> }
> 
> ```

thank you .. unfortunately doesn't working.

filter {  
if "fb-uc4" in [tags] {  
grok {  
match =\> { "message" =\> ["%{DATELOG:timestamp} %{GREEDYDATA}"] }  
pattern\_definitions =\> { "DATELOG" =\> "%{YEAR}%{MONTHNUM2}%{MONTHDAY} %{HOUR}%{MINUTE}%{SECOND}}" }  
}  
}  
}

I receive grok parse failure

REgards

Axel

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [February 3, 2023, 2:08pm UTC](https://discuss.elastic.co/t/logstash-dateformat-yyyymmdd-hhmmss/324311/4 "2023-02-03T14:08:04Z")

</div>

True, my appology, extra } after SECOND. You don't need %{GREEDYDATA}, it's optional.

```auto
    grok {
     match => { "message" => ["%{DATELOG:timestamp} "] }
     pattern_definitions => { "DATELOG" => "%{YEAR}%{MONTHNUM2}%{MONTHDAY} %{HOUR}%{MINUTE}%{SECOND}" } 
    }

      date {
	    match => ["timestamp", "YYYYMMdd HHmmss"]
        timezone => "Europe/Berlin"
	    target => "timestamp"
     }

```

Result:

```auto
{
    "@timestamp" => 2023-02-03T14:07:38.710260900Z,
     "message" => "20210611 111146 SOME Date Field",
     "timestamp" => 2021-06-11T09:11:46.000Z
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2023, 2:08pm UTC](https://discuss.elastic.co/t/logstash-dateformat-yyyymmdd-hhmmss/324311/5 "2023-03-03T14:08:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.