# Regarding grok Date Time

**URL:** <https://discuss.elastic.co/t/regarding-grok-date-time/308636>\
**Category:** Logstash\
**Created:** [July 1, 2022, 8:15am UTC](https://discuss.elastic.co/t/regarding-grok-date-time/308636 "2022-07-01T08:15:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\
**Post date:** [July 1, 2022, 8:15am UTC](https://discuss.elastic.co/t/regarding-grok-date-time/308636/1 "2022-07-01T08:15:33Z")

</div>

**In my oracle DB, I have with timestamp like this: "createdDate" =\> 2022-04-02T17:00:44.339Z**  
**But in my elasticsearch index, having createdDate as "createdDate": "2022-04-02T17:00:44Z"**  
**How can we change the format in Logstash configuration?**

I tried using grok filter below. Not resolved. Could you please suggest?

grok  
{  
match =\> {  
"created\_date" =\> "%{GREEDYDATA:createdDate}.%{GREEDYDATA:time1}"  
}  
}

Thanks,  
Suresh.

---

<div class="post-metadata">

**Author:** ![sudhagar\_ramesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sudhagar_ramesh/32/105673_2.png) [@sudhagar\_ramesh](https://discuss.elastic.co/u/sudhagar_ramesh)\
**Post date:** [July 4, 2022, 3:43pm UTC](https://discuss.elastic.co/t/regarding-grok-date-time/308636/2 "2022-07-04T15:43:48Z")

</div>

Hello @suresh_u

You can try this below which would work

```auto
filter
{
mutate {
gsub => ["createdDate", ".\d{3}", ""]
}}

```

---

<div class="post-metadata">

**Author:** ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\
**Post date:** [July 4, 2022, 3:54pm UTC](https://discuss.elastic.co/t/regarding-grok-date-time/308636/3 "2022-07-04T15:54:30Z")

</div>

thank you so much for your quick solution. @sudhagar_ramesh

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 1, 2022, 3:54pm UTC](https://discuss.elastic.co/t/regarding-grok-date-time/308636/4 "2022-08-01T15:54:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.