# Multiple Date formats in one file

**URL:** <https://discuss.elastic.co/t/multiple-date-formats-in-one-file/86725>\
**Category:** Logstash\
**Created:** [May 22, 2017, 6:38pm UTC](https://discuss.elastic.co/t/multiple-date-formats-in-one-file/86725 "2017-05-22T18:38:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jaxon\_Kochel](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@Jaxon\_Kochel](https://discuss.elastic.co/u/Jaxon_Kochel)\
**Post date:** [May 22, 2017, 6:38pm UTC](https://discuss.elastic.co/t/multiple-date-formats-in-one-file/86725/1 "2017-05-22T18:38:23Z")

</div>

Hello,

I'm having an issue with date parsing multiple dates in one file. is there anyway to do multiple message matches / GROKS depending on what the log line is?

For instance:

USING this GROK  
match =\> { "message" =\> "%{DATE:date} -? ?%{TIME:time} %{LOGLEVEL:severity} ?[%{NOTSPACE:package}]\ ?%{GREEDYDATA:message}"  
}

So that would match a log line of this type

06/09/2016 - 16:22:42.178 PM [INFO] [com.arrowstream.shipmentstatus.ShipmentStatusReceiveFM] Scanning directory \ASPD-EBIFS01\Extol\Inbound...

But...  
In that same log file there are other lines written with different date formats. So I know I would need a different grok. is it possible to say her if the line matches this grok then do this?

sample other lines in same log file

2016-04-21 13:46:23,946 INFO [org.apache.shiro.realm.AuthorizingRealm] No cache or cacheManager properties have been set. Authorization cache cannot be obtained.

06/10/2016 - 11:42:41.704 AM [INFO] [com.arrowstream.shipmentstatus.ShipmentStatusReceiveFM] Scanning directory \ASPD-EBIFS01\Extol\Inbound...

As you can see the data is ultimately written in three different ways:  
year-day-month HH:mm:ss,SSS  
year-month-day HH:mm:ss,SSS  
day/month-year HH:mm:ss,SSS

So it there anyway I can account for this?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 23, 2017, 7:23am UTC](https://discuss.elastic.co/t/multiple-date-formats-in-one-file/86725/2 "2017-05-23T07:23:50Z")

</div>

Both grok filters and date filters can list multiple expressions that will be tried in order until there's a match.

---

<div class="post-metadata">

**Author:** ![Jaxon\_Kochel](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@Jaxon\_Kochel](https://discuss.elastic.co/u/Jaxon_Kochel)\
**Post date:** [May 23, 2017, 4:12pm UTC](https://discuss.elastic.co/t/multiple-date-formats-in-one-file/86725/3 "2017-05-23T16:12:01Z")

</div>

So I can do something like this correct?

grok{  
match =\> {  
"message" =\> "%{DATESTAMP:timestamp} %{LOGLEVEL:severity} ?[%{NOTSPACE:package}] ?%{GREEDYDATA:message}"  
}  
match =\> {  
"message" =\> "%{DATE:date} - %{TIME:time} %{WORD:AM/PM}\s\*?[%{LOGLEVEL:severity}\s\*] [%{NOTSPACE:package}] %{GREEDYDATA:message}"  
}  
}

* * *

So then how would I create a new field based upon which grok field gets selected?

as in for the first one I would need  
mutate{  
add\_field =\> {"timestampTest" =\> "%{timestamp}"}  
}

and the second I would use

mutate{  
add\_field =\> {"timestampTest" =\> "%{date} %{time}"}  
}

---

<div class="post-metadata">

**Author:** ![Jaxon\_Kochel](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@Jaxon\_Kochel](https://discuss.elastic.co/u/Jaxon_Kochel)\
**Post date:** [May 23, 2017, 6:00pm UTC](https://discuss.elastic.co/t/multiple-date-formats-in-one-file/86725/4 "2017-05-23T18:00:42Z")

</div>

I have discovered the answer to both my questions now I really appreciate all the work you do on here Magnus.

Yes to part one

and then for part two i can do

if [date] {} to check if the date field exists to add a unique timestamp.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 20, 2017, 6:00pm UTC](https://discuss.elastic.co/t/multiple-date-formats-in-one-file/86725/5 "2017-06-20T18:00:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.