# Parse string to date and have difference between 2 dates **URL:** \ **Category:** Logstash\ **Created:** [February 16, 2018, 4:32pm UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219 "2018-02-16T16:32:10Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Pierre\_What\_s\_Up\_Sca](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@Pierre\_What\_s\_Up\_Sca](https://discuss.elastic.co/u/Pierre_What_s_Up_Sca)\ **Post date:** [February 16, 2018, 4:32pm UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219/1 "2018-02-16T16:32:10Z")
Hi ! I have a string with this format : Fri Feb 16 14:30:09 CET 2018 I init a field like this : mutate { add\_field =\> { "dateLog" =\> "%{message}" } } mutate { gsub =\> ["dateLog", "INFOS:\s", ""] } mutate { gsub =\> ["dateLog", "\s([0-9.]_)\s([A-Z]_)\s([^]_)(\s_)([^]_)\s([^]_)\s([^]_\s[A-Za-z]_\s[0-9]_\s[0-9:]_\s[A-Z]_\s[0-9]_)\s([0-9]{3})\s([0-9.-]_)\s([0-9.-]_)\s[A-Za-z0-9-]_\s[^]_\s[^]_\s[^]_\s", "" ] } The string format is ok, no problem with this but I need to convert it to date, and have the difference with @timestamp. How can I do ? Do you have an exemple for me ? ---
**Author:** ![cb2015](https://avatars.discourse-cdn.com/v4/letter/c/7993a0/32.png) [@cb2015](https://discuss.elastic.co/u/cb2015)\ **Post date:** [February 16, 2018, 4:44pm UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219/2 "2018-02-16T16:44:00Z")
Have you looked into the date filter to convert the string into a date more simply than your regex? [https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) From there, I think you could use the elapsed plugin to find the time difference you want. [https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-elapsed.html](https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-elapsed.html) ---
**Author:** ![Pierre\_What\_s\_Up\_Sca](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@Pierre\_What\_s\_Up\_Sca](https://discuss.elastic.co/u/Pierre_What_s_Up_Sca)\ **Post date:** [February 16, 2018, 4:51pm UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219/3 "2018-02-16T16:51:18Z")
thank you for your reply : I tried this but it does not work : date { match =\> ["dateLog", "MMM d H:mm:ss yyyy"] } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 16, 2018, 4:59pm UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219/4 "2018-02-16T16:59:40Z")
> [@Pierre\_What\_s\_Up\_Sca](#): > > Fri Feb 16 14:30:09 CET 2018 That does not match "MMM d H:mm:ss yyyy". There is a day of the week (EEE) and an identity timezone (ZZZ) in there. ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [February 16, 2018, 5:00pm UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219/5 "2018-02-16T17:00:37Z")
I used this recently at a customer, and it might help point you in the right direction... ```auto # Convert the dates to a proper timestamp. date { match => ["BEGIN", "dd/MM/YYYY HH:mm:ss.SSSSSS"] timezone => "UTC" target => "BEGIN" } date { match => ["LAST", "dd/MM/YYYY HH:mm:ss.SSSSSS"] timezone => "UTC" target => "LAST" } # If the dates parsed properly calculate the runtime in seconds (precision is ms). if "_dateparsefailure" not in [tags] { ruby { code => " event.set('[RUNTIME_SEC]', (event.get('[LAST]').to_f - event.get('[BEGIN]').to_f).round(3)); " } } ``` ---
**Author:** ![Pierre\_What\_s\_Up\_Sca](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@Pierre\_What\_s\_Up\_Sca](https://discuss.elastic.co/u/Pierre_What_s_Up_Sca)\ **Post date:** [February 17, 2018, 8:09am UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219/6 "2018-02-17T08:09:37Z")
So how can I do ? ---
**Author:** ![Pierre\_What\_s\_Up\_Sca](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@Pierre\_What\_s\_Up\_Sca](https://discuss.elastic.co/u/Pierre_What_s_Up_Sca)\ **Post date:** [February 17, 2018, 8:10am UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219/7 "2018-02-17T08:10:31Z")
Thank you for your reply I will test it when I succeed to parse my string ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 17, 2018, 1:57pm UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219/8 "2018-02-17T13:57:42Z")
> [@Pierre\_What\_s\_Up\_Sca](#): > > match =\> ["dateLog", "MMM d H:mm:ss yyyy"] That would match if dateLog were something like "Feb 16 14:30:09 2018", but you said it is formatted as "Fri Feb 16 14:30:09 CET 2018". So you need to modify the pattern to include items to match the "Fri" and "CET". The pattern has to match every part of the date string. ---
**Author:** ![Pierre\_What\_s\_Up\_Sca](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@Pierre\_What\_s\_Up\_Sca](https://discuss.elastic.co/u/Pierre_What_s_Up_Sca)\ **Post date:** [February 17, 2018, 2:14pm UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219/9 "2018-02-17T14:14:40Z")
``` "dateLog" => "Feb 16 14:30:09 2018", ``` I have change the format like you say, but nothing has changed .... I do not have a field date ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 17, 2018, 4:06pm UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219/10 "2018-02-17T16:06:50Z")
> [@Pierre\_What\_s\_Up\_Sca](#): > > I have change the format like you say, but nothing has changed So what exactly does your configuration look like? If I run logstash with this configuration ```auto input { stdin { } } output { stdout { codec => rubydebug } } filter { date { match => ["message", "MMM d H:mm:ss yyyy"] } } ``` and feed it Feb 16 14:30:09 2018, then it gets parsed... ``` "@timestamp" => 2018-02-16T19:30:09.000Z, "message" => "Feb 16 14:30:09 2018", ``` ---
**Author:** ![Pierre\_What\_s\_Up\_Sca](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@Pierre\_What\_s\_Up\_Sca](https://discuss.elastic.co/u/Pierre_What_s_Up_Sca)\ **Post date:** [February 19, 2018, 7:25am UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219/11 "2018-02-19T07:25:59Z")
Yes but how can I inject : "message" =\> "Feb 16 14:30:09 2018", in date format inside ElasticSearch ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 19, 2018, 7:26am UTC](https://discuss.elastic.co/t/parse-string-to-date-and-have-difference-between-2-dates/120219/12 "2018-03-19T07:26:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.