# Logstash - filter message

**URL:** <https://discuss.elastic.co/t/logstash-filter-message/225129>\
**Category:** Logstash\
**Created:** [March 26, 2020, 6:51am UTC](https://discuss.elastic.co/t/logstash-filter-message/225129 "2020-03-26T06:51:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rockyu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rockyu/32/65010_2.png) [@rockyu](https://discuss.elastic.co/u/rockyu)\
**Post date:** [March 26, 2020, 6:51am UTC](https://discuss.elastic.co/t/logstash-filter-message/225129/1 "2020-03-26T06:51:12Z")

</div>

If my logs is `2020-03-26-12:12:36 aaa`, I want to filter out the date like `2020-03-26-12:12:36` ,How can I do it ? My config is

```auto
grok {
      match => {"message => (?<date>([0-9|-]\S+[0-9|:]\S+)"}
      add_field => {
              "times" => "%{date}"
              }
      }

```

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [March 26, 2020, 7:41am UTC](https://discuss.elastic.co/t/logstash-filter-message/225129/2 "2020-03-26T07:41:30Z")

</div>

Hi @rockyu,

If you use e.g. Kibana, there is a _Grok Debugger_ where you can test GROK patterns.

Something like this should work

```auto
grok {
      match => { "message" => "(?<times>%{YEAR}-%{MONTHNUM}-%{MONTHDAY}-%{HOUR}:%{MINUTE}:%{SECOND}) %{DATA:string}$" }
      }

```

That gave me this result

```
{
  "times": "2020-03-26-12:12:36",
  "string": "aaa"
}
```

---

<div class="post-metadata">

**Author:** ![rockyu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rockyu/32/65010_2.png) [@rockyu](https://discuss.elastic.co/u/rockyu)\
**Post date:** [March 26, 2020, 9:04am UTC](https://discuss.elastic.co/t/logstash-filter-message/225129/3 "2020-03-26T09:04:17Z")

</div>

Thanks for helping to solve this problem 😀

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2020, 9:04am UTC](https://discuss.elastic.co/t/logstash-filter-message/225129/4 "2020-04-23T09:04:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.