# Match timestamp and assign it as @datetime field

**URL:** <https://discuss.elastic.co/t/match-timestamp-and-assign-it-as-datetime-field/65087>\
**Category:** Logstash\
**Created:** [November 5, 2016, 7:38am UTC](https://discuss.elastic.co/t/match-timestamp-and-assign-it-as-datetime-field/65087 "2016-11-05T07:38:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Emmanuel\_CHANSON](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emmanuel_chanson/32/12938_2.png) [@Emmanuel\_CHANSON](https://discuss.elastic.co/u/Emmanuel_CHANSON)\
**Post date:** [November 5, 2016, 7:38am UTC](https://discuss.elastic.co/t/match-timestamp-and-assign-it-as-datetime-field/65087/1 "2016-11-05T07:38:08Z")

</div>

I have the following array:  
{  
"\_index": "index\_json",  
"\_type": "json",  
"\_id": "AVgzYPhrIoaQPqcpVgK8",  
"\_score": null,  
"\_source": {  
"path": "/tmp/CSV/data.json",  
"@timestamp": "2016-11-05T07:25:41.023Z",  
"jobs": {  
"name": "Onboarding\_Deploy\_E1DEV4",  
"builds": {  
"duration": 867357,  
"number": 2225,  
"timestamp": 1476977583380  
}  
},  
"@version": "1",  
"host": "[ks3309573.kimsufi.com](http://ks3309573.kimsufi.com)",  
"type": "json"  
},  
"fields": {  
"@timestamp": [  
1478330741023  
]  
},  
"sort": [  
1478330741023  
]  
}

I need to match the field "timestamp": 1476977583380 in builds and assign it to @datetime.

I tried the following config in filter but logstat can not start:

filter {  
split { field =\> "[jobs]" }  
split { field =\> "[jobs][builds]" }  
**date {**  
\*\* match =\> ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z”]\*\*  
\*\* remove\_field =\> "timestamp"\*\*  
\*\* }\*\*  
}

BR

---

<div class="post-metadata">

**Author:** ![Emmanuel\_CHANSON](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emmanuel_chanson/32/12938_2.png) [@Emmanuel\_CHANSON](https://discuss.elastic.co/u/Emmanuel_CHANSON)\
**Post date:** [November 5, 2016, 8:48am UTC](https://discuss.elastic.co/t/match-timestamp-and-assign-it-as-datetime-field/65087/2 "2016-11-05T08:48:57Z")

</div>

Tried this but no success:  
date {  
match =\> ["timestamp", "UNIX\_MS"]  
target =\> "@timestamp"  
remove\_field =\> "timestamp"  
}

An example:  
{  
"path" =\> "/tmp/CSV/data.json",  
"@timestamp" =\> 2016-11-05T09:06:27.205Z,  
"jobs" =\> {  
"name" =\> "Onboarding\_Sanity\_E1QA",  
"builds" =\> {  
"duration" =\> 1933,  
"number" =\> 176,  
"timestamp" =\> 1471631216231  
}  
},  
"@version" =\> "1",  
"host" =\> "[ks3309573.kimsufi.com](http://ks3309573.kimsufi.com)",  
"type" =\> "json"  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 5, 2016, 12:33pm UTC](https://discuss.elastic.co/t/match-timestamp-and-assign-it-as-datetime-field/65087/3 "2016-11-05T12:33:54Z")

</div>

Why are you using the pattern "dd/MMM/YYYY:HH:mm:ss Z" when your timestamp doesn't even resemble that format? I'm guessing the your timestamp are milliseconds since the epoch (i.e. 1476977583380 is Oct 20 at 15:33 UTC). Use the "UNIX\_MS" pattern instead.

Secondly, it appears the timestamp field is nested two levels down and this needs to be taken into account. This should work:

```nohighlight
date {
  match => ["[jobs][builds][timestamp]", "UNIX_MS"]
  remove_field => ["[jobs][builds][timestamp]"]
}

```

---

<div class="post-metadata">

**Author:** ![Emmanuel\_CHANSON](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emmanuel_chanson/32/12938_2.png) [@Emmanuel\_CHANSON](https://discuss.elastic.co/u/Emmanuel_CHANSON)\
**Post date:** [November 6, 2016, 3:56am UTC](https://discuss.elastic.co/t/match-timestamp-and-assign-it-as-datetime-field/65087/4 "2016-11-06T03:56:18Z")

</div>

Thanks a lot, it is the solution.

Regards

Emmanuel

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 4, 2016, 3:56am UTC](https://discuss.elastic.co/t/match-timestamp-and-assign-it-as-datetime-field/65087/5 "2016-12-04T03:56:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.