# Logstash grok timestamp from message: issue with multiple timestamp format

**URL:** <https://discuss.elastic.co/t/logstash-grok-timestamp-from-message-issue-with-multiple-timestamp-format/25717>\
**Category:** Logstash\
**Created:** [July 16, 2015, 11:27am UTC](https://discuss.elastic.co/t/logstash-grok-timestamp-from-message-issue-with-multiple-timestamp-format/25717 "2015-07-16T11:27:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Post date:** [July 16, 2015, 11:27am UTC](https://discuss.elastic.co/t/logstash-grok-timestamp-from-message-issue-with-multiple-timestamp-format/25717/1 "2015-07-16T11:27:44Z")

</div>

Hi  
I am taking out timestamp field from message and setting it as eventTime as new field.  
below is the code I am using.

```
grok { 
    match => { "message" => "%{TIMESTAMP_ISO8601:eventTime}" } 
  }
  date { 
    match => ["eventTime", "YYYY-MM-dd HH:mm:ss"]
	target => "eventTime"
  }

```

there is one problem with this. It only works with the record which has YYYY-MM-dd HH:mm:ss format. It throws "java.lang.IllegalArgumentException: Invalid format:" exception for logs having different format.

I have many clients with different time formats. I don't want to write too many if else in the filter. Any other option?  
Please guide me on this, how to solve this issue?

thanks  
Sunil

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 16, 2015, 11:50am UTC](https://discuss.elastic.co/t/logstash-grok-timestamp-from-message-issue-with-multiple-timestamp-format/25717/2 "2015-07-16T11:50:13Z")

</div>

The date filter accepts multiple date patterns and tries hem in order until it gets a match. See the [documentation of the `match` parameter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-match).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:34am UTC](https://discuss.elastic.co/t/logstash-grok-timestamp-from-message-issue-with-multiple-timestamp-format/25717/3 "2017-07-06T05:34:29Z")

</div>