# Process date via in logstash
**URL:** https://discuss.elastic.co/t/process-date-via-in-logstash/112665
**Category:** Logstash
**Created:** [December 20, 2017, 3:21pm UTC](https://discuss.elastic.co/t/process-date-via-in-logstash/112665 "2017-12-20T15:21:04Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@moriol](https://discuss.elastic.co/u/moriol)
#### Post date: [December 20, 2017, 3:21pm UTC](https://discuss.elastic.co/t/process-date-via-in-logstash/112665/1 "2017-12-20T15:21:04Z")
I have a date in specific form, its as follows;
"MyDate" =\> "[20, 12, 17, 14, 31, 28, 2, 4]", which is supposed to be 20/12/17 14:31 24ms
What is the best way to format this in Logstash?
I believe I can use a match, but how to combine the last 2, 4 to create 24ms?
date {
match =\> [
"MyDate", "dd, MM, yy, HH, mm, ss, S, S"
]
}
---
### Author:  [@arisbanach](https://discuss.elastic.co/u/arisbanach)
#### Post date: [December 20, 2017, 3:27pm UTC](https://discuss.elastic.co/t/process-date-via-in-logstash/112665/2 "2017-12-20T15:27:31Z")
Maybe use grok to change it to `"MyDate" => "[20, 12, 17, 14, 31, 28, 24]"` and then use date on that field?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 20, 2017, 3:33pm UTC](https://discuss.elastic.co/t/process-date-via-in-logstash/112665/3 "2017-12-20T15:33:46Z")
Depending on what a date with (say) 8ms in it looks like (do you get [20, 12, 17, 14, 31, 28, 0, 8] ?) you could build a parseable date field using
```
mutate { add_field => { "date" => "%{[MyDate][0]}/%{[MyDate][1]}/%{[MyDate][2]} %{[MyDate][3]}:%{[MyDate][4]}:%{[MyDate][5]}.%{[MyDate][6]}%{[MyDate][7]}" } }
```
---
### Author:  [@moriol](https://discuss.elastic.co/u/moriol)
#### Post date: [December 20, 2017, 3:56pm UTC](https://discuss.elastic.co/t/process-date-via-in-logstash/112665/4 "2017-12-20T15:56:43Z")
> [@Badger](#):
>
> mutate { add\_field =\> { "date" =\> "%{[MyDate][0]}/%{[MyDate][1]}/%{[MyDate][2]} %{[MyDate][3]}:%{[MyDate][4]}:%{[MyDate][5]}.%{[MyDate][6]}%{[MyDate][7]}" }
Yes, your are correct, I would get [20, 12, 17, 14, 31, 28, 0, 8]
I tried your suggestion but get something like this in output:
"date" =\> "%{[MyDate][0]}/%{[MyDate][1]}/%{[MyDate][2]} %{[MyDate][3]}:%{[MyDate][4]}:%{[MyDate][5]}.%{[MyDate][6]}%{[MyDate][7]}"
Any suggestions?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 20, 2017, 4:00pm UTC](https://discuss.elastic.co/t/process-date-via-in-logstash/112665/6 "2017-12-20T16:00:40Z")
That indicates that you do not have an array called MyDate, which is what I thought you were saying you had. Can you dump a message into "output { stdout { codec =\> rubydebug } }" so that we can see what the incoming data looks like?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 17, 2018, 4:00pm UTC](https://discuss.elastic.co/t/process-date-via-in-logstash/112665/7 "2018-01-17T16:00:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.