# Logstash timestamp with CEST
**URL:** https://discuss.elastic.co/t/logstash-timestamp-with-cest/136312
**Category:** Logstash
**Created:** [June 18, 2018, 1:16pm UTC](https://discuss.elastic.co/t/logstash-timestamp-with-cest/136312 "2018-06-18T13:16:17Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@ginu](https://discuss.elastic.co/u/ginu)
#### Post date: [June 18, 2018, 1:16pm UTC](https://discuss.elastic.co/t/logstash-timestamp-with-cest/136312/1 "2018-06-18T13:16:18Z")
Hi all
I have a timestamp in the log which has the follwing format
",xxxxxxx, **Thu May 31 09:40:46 CEST 2018** ,yyyyyy...."
I tried to have the config
...
...
filter {
if ([path] =~ /log/) {
csv {
columns =\> [
"eventId", **"eventTime"** ,"eventLevel"
]
separator =\> ";"
}
}
}
the eventTime i am getting it as string and would like to have the datatype as **date**.
Regards, ginu
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 18, 2018, 1:20pm UTC](https://discuss.elastic.co/t/logstash-timestamp-with-cest/136312/2 "2018-06-18T13:20:47Z")
You can use a date filter to parse the string and store it as an ISO8601 timestamp that Elasticsearch will treat as a date. Keep in mind that the existing mapping of the field won't change so you'll have to reindex existing data or just make sure a new index is created.
---
### Author:  [@ginu](https://discuss.elastic.co/u/ginu)
#### Post date: [June 18, 2018, 1:25pm UTC](https://discuss.elastic.co/t/logstash-timestamp-with-cest/136312/3 "2018-06-18T13:25:08Z")
Thanks Magnus
sorry again for asking may be a silly question...
does it mean that I need to
filter {
date {
match =\> ["eventTime", "ISO8601"]
}
}
> [@magnusbaeck](#):
>
> use a date filter to parse the string
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 18, 2018, 1:33pm UTC](https://discuss.elastic.co/t/logstash-timestamp-with-cest/136312/4 "2018-06-18T13:33:46Z")
Yes, except not ISO8601 since the date you want to parse isn't in ISO8601 format. See the date filter documentation for more information.
---
### Author:  [@ginu](https://discuss.elastic.co/u/ginu)
#### Post date: [June 18, 2018, 3:28pm UTC](https://discuss.elastic.co/t/logstash-timestamp-with-cest/136312/5 "2018-06-18T15:28:14Z")
- I tried
date {
match =\> ["eventTime", "EEE MMM dd HH:mm:ss yyyy"]
}
did not work!
- I also tried:
and created a new Index ... it still created the eventTime as String and had the value as **Mon Jun 18 16:59:35 2018**
but did not store it as timestamp.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 18, 2018, 6:15pm UTC](https://discuss.elastic.co/t/logstash-timestamp-with-cest/136312/6 "2018-06-18T18:15:47Z")
If you want the date filter to write the parsed result back to the same field you need to adjust the `target` option.
---
### Author:  [@ginu](https://discuss.elastic.co/u/ginu)
#### Post date: [June 18, 2018, 10:49pm UTC](https://discuss.elastic.co/t/logstash-timestamp-with-cest/136312/7 "2018-06-18T22:49:55Z")
Thanks Magnus that helped!!
with the following code i was able to achieve what I wanted
```
mutate {
gsub => ["eventTime", "CEST", ""]
}
date {
match => ["eventTime", "EEE MMM dd HH:mm:ss yyyy"]
target => "eventTime"
}
```
Great!!!
> [@magnusbaeck](#):
>
> target
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 16, 2018, 11:01pm UTC](https://discuss.elastic.co/t/logstash-timestamp-with-cest/136312/8 "2018-07-16T23:01:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.