# Logstash Filtering Grabbing Partial Date

**URL:** <https://discuss.elastic.co/t/logstash-filtering-grabbing-partial-date/186257>\
**Category:** Logstash\
**Created:** [June 18, 2019, 1:09pm UTC](https://discuss.elastic.co/t/logstash-filtering-grabbing-partial-date/186257 "2019-06-18T13:09:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [June 18, 2019, 1:09pm UTC](https://discuss.elastic.co/t/logstash-filtering-grabbing-partial-date/186257/1 "2019-06-18T13:09:50Z")

</div>

date {  
match =\> ["event\_at", "yyyy-MM-dd'T'HH:mm:ss.SSSZ"]  
}

How would i Grab just "yyyy-MM-dd'T'HH" and send it to a new field ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 18, 2019, 1:44pm UTC](https://discuss.elastic.co/t/logstash-filtering-grabbing-partial-date/186257/2 "2019-06-18T13:44:18Z")

</div>

Copy it to another field and then

```
mutate { gsub => ["ts", "^(\d{4}-\d{2}-\d{2}T\d{2}).*", "\1"] }

```

We use a capture group () to surround the part of the field we want to keep, and follow that with .\* which will consume everything we do not want to keep. "\1" says to replace the text that the pattern matched (the entire field) with the contents of the first capture group.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 16, 2019, 1:51pm UTC](https://discuss.elastic.co/t/logstash-filtering-grabbing-partial-date/186257/3 "2019-07-16T13:51:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.