# No default Year/month/day for only HH:mm:ss,SSS logs **URL:** \ **Category:** Logstash\ **Created:** [January 7, 2020, 11:55am UTC](https://discuss.elastic.co/t/no-default-year-month-day-for-only-hhss-sss-logs/214043 "2020-01-07T11:55:48Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![drubior](https://avatars.discourse-cdn.com/v4/letter/d/d26b3c/32.png) [@drubior](https://discuss.elastic.co/u/drubior)\ **Post date:** [January 7, 2020, 11:55am UTC](https://discuss.elastic.co/t/no-default-year-month-day-for-only-hhss-sss-logs/214043/1 "2020-01-07T11:55:48Z")
We have some logfiles wich store only the time in format "HH:mm:ss,SSS" ( no day, month, year info) **11:38:58,654 INFO [ajp-195.72.2xx.17-8109-722] [lm.PerfilLoginModule] : [TOKEN\_OK] authenticated user pepito** This has never been a problem until about a month (I haven't been able to find the exact date), we catched the hour, and logstash automatically added the year/mont/date, and added it to the daily index... We use this: > if [logname] == "egovern" { > grok { > match =\> [ > #Jboss > "message", "(%{TIMESTAMP\_ISO8601:timestamp}|%{DATESTAMP:timestamp}|%{TIME:timestamp})%{SPACE}%{LOGLEVEL:level}%{SPACE}([%{DATA:logger}]+) [%{DATA:method}] : %{GREEDYDATA:message}" > > ``` > ] > overwrite => ["message"] > } > > date { > match => ["timestamp" , "HH:mm:ss,SSS"] > # target => "@timestamp" > } > > ``` And the destination index is: > index =\> "%{[@metadata][destindex]}-%{+YYYY.MM.dd}" Since that misterious moment, those logs are being sent to **index\_name-2020-01-01** instead of for example **index\_name-2020-01-07** (this was happening too in 2019) I've been reading and it seems that in those cases the date info was provided internally by logstash, or at least it was the same that it was in the @timestamp field, and I think this was the case until some time ago, but actually it's not :\_( How could I solve it? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 7, 2020, 4:12pm UTC](https://discuss.elastic.co/t/no-default-year-month-day-for-only-hhss-sss-logs/214043/2 "2020-01-07T16:12:28Z")
If the year or month is not supplied the date filter will definitely get it wrong sometimes. See [this](https://github.com/logstash-plugins/logstash-filter-date/issues/51) issue. ---
**Author:** ![drubior](https://avatars.discourse-cdn.com/v4/letter/d/d26b3c/32.png) [@drubior](https://discuss.elastic.co/u/drubior)\ **Post date:** [January 9, 2020, 1:44pm UTC](https://discuss.elastic.co/t/no-default-year-month-day-for-only-hhss-sss-logs/214043/3 "2020-01-09T13:44:12Z")
Yeah, I undestand, but is not sometimes, it's always... And is always 2020-01-01the destination index... I'm almost sure that was working, and it started failing before the end of the year... ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 9, 2020, 4:44pm UTC](https://discuss.elastic.co/t/no-default-year-month-day-for-only-hhss-sss-logs/214043/4 "2020-01-09T16:44:56Z")
> [@drubior](#): > > index =\> "%{[@metadata][destindex]}-%{+YYYY.MM.dd}" If that is your index option and the documents are indexed into index\_name-2020-01-01 then the documents are not going through that elasticsearch output (. vs. -) ---
**Author:** ![drubior](https://avatars.discourse-cdn.com/v4/letter/d/d26b3c/32.png) [@drubior](https://discuss.elastic.co/u/drubior)\ **Post date:** [January 10, 2020, 12:04pm UTC](https://discuss.elastic.co/t/no-default-year-month-day-for-only-hhss-sss-logs/214043/5 "2020-01-10T12:04:31Z")
Sorry, it was my fault, the destination index is logstash-aplicacions-2020.01.01 I've seen in other forum post a possible workaround, but I'm not sure if it would be a good solution, because I would have to apply it for every log input with this format, making even more complicated the processing > [@Time without a date field](https://discuss.elastic.co/t/time-without-a-date-field/27282): > > I have logs that only have a time field i.e. HH:mm:ss.SSS but for some reason there are no dates! I want to include today's date to this field called logstoretime. Because if I do not specify a date filter the time difference from when log gets shipped to when it is processed is to large of a gap ~10minutes. So essentially I want it to log by depending on the day it will pull that date and use my HH:mm:ss.SSS Anyone with this experience? I've also seen in the elastic docs, that it seems that is necessary to provide the year month day info, I don't know how it's been working until a few days... I'm starting to thing that maybe developers changed the log format... > **[Date field type | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/date.html)** ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 7, 2020, 12:14pm UTC](https://discuss.elastic.co/t/no-default-year-month-day-for-only-hhss-sss-logs/214043/6 "2020-02-07T12:14:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.