# Parsing date - day changes number of digits

**URL:** <https://discuss.elastic.co/t/parsing-date-day-changes-number-of-digits/62303>\
**Category:** Logstash\
**Created:** [October 5, 2016, 5:36pm UTC](https://discuss.elastic.co/t/parsing-date-day-changes-number-of-digits/62303 "2016-10-05T17:36:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roberto\_Iglesias](https://avatars.discourse-cdn.com/v4/letter/r/f1d935/32.png) [@Roberto\_Iglesias](https://discuss.elastic.co/u/Roberto_Iglesias)\
**Post date:** [October 5, 2016, 5:36pm UTC](https://discuss.elastic.co/t/parsing-date-day-changes-number-of-digits/62303/1 "2016-10-05T17:36:04Z")

</div>

Hi and thanks for reading  
I'm building my logstash filter and i just realized that the number of digits in day space changes.  
For example:

```
Oct 2 13:13:13 #two spaces between month and day
Oct 12 22:22:22 #one space between mont and day but two digits for day

```

If i do this:

```
date {
    match => ["real_timestamp", "MMM dd HH:mm:ss"]
    target => "@timestamp"
}

```

match the second case, but obviously not the first.

What can i do?  
Thanks!

---

<div class="post-metadata">

**Author:** ![wiibaa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wiibaa/32/44931_2.png) [@wiibaa](https://discuss.elastic.co/u/wiibaa)\
**Post date:** [October 5, 2016, 6:44pm UTC](https://discuss.elastic.co/t/parsing-date-day-changes-number-of-digits/62303/2 "2016-10-05T18:44:26Z")

</div>

Indeed, your only option is to specify both patterns like

```
date {
match => ["real_timestamp", "MMM dd HH:mm:ss", "MMM d HH:mm:ss"]
target => "@timestamp"

```

}

---

<div class="post-metadata">

**Author:** ![Roberto\_Iglesias](https://avatars.discourse-cdn.com/v4/letter/r/f1d935/32.png) [@Roberto\_Iglesias](https://discuss.elastic.co/u/Roberto_Iglesias)\
**Post date:** [October 7, 2016, 1:19pm UTC](https://discuss.elastic.co/t/parsing-date-day-changes-number-of-digits/62303/3 "2016-10-07T13:19:53Z")

</div>

Thanks so much, that's right

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/parsing-date-day-changes-number-of-digits/62303/4 "2017-07-06T04:35:13Z")

</div>