# Merge or combine 2 different input fields as 1
**URL:** https://discuss.elastic.co/t/merge-or-combine-2-different-input-fields-as-1/218420
**Category:** Logstash
**Created:** [February 7, 2020, 11:06pm UTC](https://discuss.elastic.co/t/merge-or-combine-2-different-input-fields-as-1/218420 "2020-02-07T23:06:27Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@jrodbor](https://discuss.elastic.co/u/jrodbor)
#### Post date: [February 7, 2020, 11:06pm UTC](https://discuss.elastic.co/t/merge-or-combine-2-different-input-fields-as-1/218420/1 "2020-02-07T23:06:28Z")
Hello,
I the input CSV file I have the timestamp file separate by a TAB, one as "date" and another as "time", is it possible load is as the timestamp one ? What is the code to doing it ?
input {
file {
path =\> "/Users/XXX/some\_log.csv"
start\_position =\> "beginning"
sincedb\_path =\> "/dev/null"
}
}
filter {
csv {
separator =\> ","
columns =\> ["system\_date","system\_time","ip","host"]
}
}
output {
elasticsearch {
hosts =\> "[http://localhost:9200](http://localhost:9200)"
index =\> "data-index"
}
stdout {}
}
Regards,
Jonny
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 8, 2020, 12:46am UTC](https://discuss.elastic.co/t/merge-or-combine-2-different-input-fields-as-1/218420/2 "2020-02-08T00:46:31Z")
Use mutate+add\_field with two [sprintf](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#sprintf) references to combine the date and time, then use a date filter to parse it.
---
### Author:  [@jrodbor](https://discuss.elastic.co/u/jrodbor)
#### Post date: [February 10, 2020, 5:27pm UTC](https://discuss.elastic.co/t/merge-or-combine-2-different-input-fields-as-1/218420/3 "2020-02-10T17:27:38Z")
Thanks a lot for the suggestion, did it and it works, however notice that the timestamp is getting back a month in the past, i.e. "2020-02-01 10:10:00" moves to "2020-01-01T09:10:00Z", any ideas what i'm missing to put it in the right way ?
Timing is also getting an hour before but found that is because the conversion is always based in UTC so it is ok.
This is the code that i'm using:
input {
file {
path =\> "./logs/access\*.log"
start\_position =\> "beginning"
sincedb\_path =\> "NUL"
}
}
filter {
csv {
separator =\> ","
columns =\> ["date-event", "time-event", "time-taken"]
}
mutate {convert =\> ["time-taken", "float"]}
mutate {add\_field =\> {"transaction-timestamp" =\> "%{date-event} %{time-event}"}}
```
date {
match => ["transaction-timestamp", "YYYY-MM-DD HH:mm:ss"]
locale => "en"
timezone => "Europe/Paris"
target => "@timestamp"
}
```
}
output {
elasticsearch {
hosts =\> "localhost"
index =\> "stats"
document\_type =\> "trafic"
}
stdout {}
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 10, 2020, 7:11pm UTC](https://discuss.elastic.co/t/merge-or-combine-2-different-input-fields-as-1/218420/4 "2020-02-10T19:11:19Z")
DD is day of the year, so 01 is January first, and that overwrites the month. Use dd.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 9, 2020, 7:11pm UTC](https://discuss.elastic.co/t/merge-or-combine-2-different-input-fields-as-1/218420/5 "2020-03-09T19:11:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.