# Logstash + Get DateTime from filename
**URL:** https://discuss.elastic.co/t/logstash-get-datetime-from-filename/49808
**Category:** Logstash
**Created:** [May 11, 2016, 5:28pm UTC](https://discuss.elastic.co/t/logstash-get-datetime-from-filename/49808 "2016-05-11T17:28:34Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@sarthak2016](https://discuss.elastic.co/u/sarthak2016)
#### Post date: [May 11, 2016, 5:28pm UTC](https://discuss.elastic.co/t/logstash-get-datetime-from-filename/49808/1 "2016-05-11T17:28:34Z")
Hello All,
I am facing a issue to fetch the DateTime from filename.
Input File name : ServerInfo\_04022016 1204.csv
Expected output to Fetch DateTime : 04/02/2016 12:04
input {
file {
path =\> "C:\logstash-2.3.1\CSV\ServerInfo\_04022016 1204.csv"
type=\>"sql"
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 12, 2016, 6:44pm UTC](https://discuss.elastic.co/t/logstash-get-datetime-from-filename/49808/2 "2016-05-12T18:44:16Z")
Use a grok filter to parse the `path` field. Something like this:
```nohighlight
filter {
grok {
match => ["path", "_%{MONTHNUM:month}%{MONTHDAY:day}%{YEAR:year} %{HOUR:hour}%{MINUTE:minute}\.csv$"]
add_field => ["datetime", "%{month}/%{day}/%{year} %{hour}:%{minute}"]
}
mutate {
remove_field => ["month", "day", "year", "hour", "minute"]
}
}
```
(I'm assuming that the date in the filename is mmddyyyy. If not the expression needs to be adjusted.)
---
### Author:  [@sarthak2016](https://discuss.elastic.co/u/sarthak2016)
#### Post date: [May 17, 2016, 6:18pm UTC](https://discuss.elastic.co/t/logstash-get-datetime-from-filename/49808/3 "2016-05-17T18:18:48Z")
Hello Magnus,
Thanks for your response, your solution is working fine,
But i need one more suggestion/help from you.
In mapping document, i have already defined field and its type,
Below is the syntax for mapping document for this one.
"logruntime": {
"type": "date",
"format": "epoch\_millis||MM/dd/yyyy HH:mm"
}
how i can add value into logruntime field rather than create add\_field "datetime".
Thanks for your help in Advance,
Sam
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 17, 2016, 6:42pm UTC](https://discuss.elastic.co/t/logstash-get-datetime-from-filename/49808/4 "2016-05-17T18:42:42Z")
So... change the `add_field` option to name the new field `logruntime` instead of `datetime`? Or am I misunderstanding the question?
---
### Author:  [@sarthak2016](https://discuss.elastic.co/u/sarthak2016)
#### Post date: [June 8, 2016, 9:43pm UTC](https://discuss.elastic.co/t/logstash-get-datetime-from-filename/49808/5 "2016-06-08T21:43:55Z")
Hello Magnus,
Your solution works fine,
But now i have to add seconds as well.
Input File name : ServerInfo\_04022016 120401.csv
Expected output to Fetch DateTime : 04/02/2016 12:04:01
filter {
grok {
match =\> ["path", "\_%{MONTHNUM:month}%{MONTHDAY:day}%{YEAR:year} %{HOUR:hour}%{MINUTE:minute}%{SECOND:second}.csv$"]
add\_field =\> ["ScriptRunTime", "%{month}/%{day}/%{year} %{hour}:%{minute}:%{second}"]
}
mutate {
remove\_field =\> ["month", "day", "year", "hour", "minute","second"]
}
}
I use the same code and add "second" but it throws an error.
400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [S criptRunTime]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"I
nvalid format: "04/02/2016 12:04:00" is malformed at ":00""}}}}, :level=\>:wa
rn}←[0m
---
### Author:  [@sarthak2016](https://discuss.elastic.co/u/sarthak2016)
#### Post date: [June 8, 2016, 10:08pm UTC](https://discuss.elastic.co/t/logstash-get-datetime-from-filename/49808/6 "2016-06-08T22:08:39Z")
No worries, it works fine now.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/logstash-get-datetime-from-filename/49808/7 "2017-07-06T04:54:02Z")