# Multiple dates in log file defining the @timestamp date

**URL:** <https://discuss.elastic.co/t/multiple-dates-in-log-file-defining-the-timestamp-date/44233>\
**Category:** Logstash\
**Created:** [March 12, 2016, 7:26pm UTC](https://discuss.elastic.co/t/multiple-dates-in-log-file-defining-the-timestamp-date/44233 "2016-03-12T19:26:52Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans)\
**Post date:** [March 12, 2016, 7:26pm UTC](https://discuss.elastic.co/t/multiple-dates-in-log-file-defining-the-timestamp-date/44233/1 "2016-03-12T19:26:52Z")

</div>

Hi, I have a challenge, in the log-file of mine, I have three dates and would like to define the 3rd one as the @timestamp that is reflected in the ES and Kibana searches. What filter can I apply for this as the date one does not work?

Here is a example of the log-file:  
`Feb 29 03:15:26 172.29.58.134 804 <14>1 2016-02-29T03:15:30+02:00 10.10.10.12 1 - - - 2016-02-29T03:15:30.330+02:00 .........`

Currently the imported date is the @timestamp for all the logs, I would like to get "2016-02-29T03:15:30.330+02:00 " as my timestamp

Thank you

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 12, 2016, 8:51pm UTC](https://discuss.elastic.co/t/multiple-dates-in-log-file-defining-the-timestamp-date/44233/2 "2016-03-12T20:51:44Z")

</div>

Why does the `date` filter not work, it should. Perhaps providing your config would help.

---

<div class="post-metadata">

**Author:** ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans)\
**Post date:** [March 13, 2016, 5:33am UTC](https://discuss.elastic.co/t/multiple-dates-in-log-file-defining-the-timestamp-date/44233/3 "2016-03-13T05:33:52Z")

</div>

HI, here is the filter:

`if "FLOWCREATE" in [tags] {  
grok {  
match =\> ["messages", "%{SYSLOGTIMESTAMP:Date1} %{SYSLOGHOST} %{CISCO\_REASON}%{SYSLOGPROG} %{TIMESTAMP\_ISO8601:Date2} %{IPORHOST} %{CISCO\_REASON}- - - %{TIMESTAMP\_ISO8601:Date3} %{HOSTNAME} RT\_FLOW - RT\_FLOW\_SESSION\_CREATE\_LS %{SYSLOG5424PRINTASCII}: .\* "]  
add\_field =\> ["received\_on", "%{@timestamp}"]  
add\_field =\> ["received\_frem", "%{host}"]  
tag\_on\_failure =\> []  
add\_tag =\> "FLOWCREATE"  
}

date {  
match =\> ["Date3", "yyyy-MM-dd HH:mm:ss.SSSZ"]  
}

mutate {  
split =\> ["messages", " "]  
}  
kv{  
field\_split =\> " "  
}  
`

---

<div class="post-metadata">

**Author:** ![wiibaa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wiibaa/32/44931_2.png) [@wiibaa](https://discuss.elastic.co/u/wiibaa)\
**Post date:** [March 13, 2016, 7:30am UTC](https://discuss.elastic.co/t/multiple-dates-in-log-file-defining-the-timestamp-date/44233/4 "2016-03-13T07:30:50Z")

</div>

To match a timezone like `+02:00`, the correct pattern is `ZZ` to match **offset with a colon**  
`Z` is matching offset without a colon  
HTH

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 13, 2016, 7:48am UTC](https://discuss.elastic.co/t/multiple-dates-in-log-file-defining-the-timestamp-date/44233/5 "2016-03-13T07:48:14Z")

</div>

> [@Hans](#):
>
> date { match =\> ["Date3", "yyyy-MM-dd HH:mm:ss.SSSZ"]}

As your Date3 field is in ISO8601 format, you should be able to define the date filter like this:

```
  date {
    match => ["message", "ISO8601"]
  }

```

Note that the date filter always converts to UTC as this is required in Elasticsearch.

---

<div class="post-metadata">

**Author:** ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans)\
**Post date:** [March 13, 2016, 8:35am UTC](https://discuss.elastic.co/t/multiple-dates-in-log-file-defining-the-timestamp-date/44233/6 "2016-03-13T08:35:56Z")

</div>

Thank you wiibaa and Christian\_Dahlqvist for the feedback. I used both suggestions and it works now, thank you:  
`date { locale => "en" match => ["Date3", "yyyy-MM-dd HH:mm:ss.SSSZZ", "ISO8601"] timezone => "Africa/Windhoek" target => "@timestamp" add_field => { "debug" => "timestampMatched"} }`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:07am UTC](https://discuss.elastic.co/t/multiple-dates-in-log-file-defining-the-timestamp-date/44233/7 "2017-07-06T05:07:15Z")

</div>

Closed on July 6, 2017, 5:07am UTC