# Removing seconds from time stamp field **URL:** \ **Category:** Logstash\ **Created:** [November 6, 2015, 1:58pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995 "2015-11-06T13:58:10Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![bubu.senapati](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Post date:** [November 6, 2015, 1:58pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/1 "2015-11-06T13:58:10Z")
i want to make the seconds field from the timestamp field 2015-10-27T00:07:20.168+0000 in logstash 00 and create the new time stamp. Could u please help me how can i achieve this. From 2015-10-27T00:07:20.168+0000 to 2015-10-27T00:07:00.168+0000 regards Dibya ---
**Author:** ![bubu.senapati](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Post date:** [November 6, 2015, 2:15pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/2 "2015-11-06T14:15:11Z")
or also how can we make 2015-10-27T00:07:20 to 2015-10-27T00:07:00. Anyways look forward to somebody's help on this ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 6, 2015, 2:27pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/3 "2015-11-06T14:27:56Z")
You can e.g. use the mutate filter's gsub option. If there aren't any milliseconds or a timezone this should work: ``` mutate { gsub => ["timestamp", ":\d\d$", ":00"] } ``` ---
**Author:** ![bubu.senapati](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Post date:** [November 6, 2015, 2:29pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/4 "2015-11-06T14:29:37Z")
But if there is a timezone and millisecond then how can i go about it ---
**Author:** ![bubu.senapati](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Post date:** [November 6, 2015, 2:30pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/5 "2015-11-06T14:30:39Z")
my timestamp is like 2015-10-27T00:07:20.168+0000. how can i do this to 2015-10-27T00:07:00.168+0000 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 6, 2015, 2:32pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/6 "2015-11-06T14:32:29Z")
Well, it's basically the same. It's just that the seconds are followed by a period instead of the $ end-of-string marker. Don't forget that periods need to be escaped to be taken literally. ---
**Author:** ![bubu.senapati](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Post date:** [November 6, 2015, 2:34pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/7 "2015-11-06T14:34:56Z")
thanks magnus .you are always a help. Let me try ---
**Author:** ![bubu.senapati](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Post date:** [November 6, 2015, 3:28pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/8 "2015-11-06T15:28:43Z")
could you please give me the exact expression of gsub for my timestamp which is with millisecond and timezone ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 6, 2015, 3:29pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/9 "2015-11-06T15:29:42Z")
``` mutate { gsub => ["timestamp", ":\d\d\.", ":00."] } ``` ---
**Author:** ![bubu.senapati](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Post date:** [November 6, 2015, 3:37pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/10 "2015-11-06T15:37:02Z")
not working 😢 ---
**Author:** ![bubu.senapati](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Post date:** [November 6, 2015, 3:39pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/11 "2015-11-06T15:39:24Z")
magnus, 1 more thing i want to tell. I don't want to cut down time zone field . just want to change the seconds field to 00. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 6, 2015, 3:47pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/12 "2015-11-06T15:47:31Z")
Works just fine for me. Over and out. ``` $ cat test.config input { stdin { } } output { stdout { codec => rubydebug } } filter { mutate { gsub => ["message", ":\d\d\.", ":00."] } } $ echo '2015-10-27T00:07:20.168+0000' | /opt/logstash/bin/logstash -f test.config Logstash startup completed { "message" => "2015-10-27T00:07:00.168+0000", "@version" => "1", "@timestamp" => "2015-11-06T15:46:51.272Z", "host" => "lnxolofon" } Logstash shutdown completed ``` ---
**Author:** ![bubu.senapati](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Post date:** [November 6, 2015, 5:40pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/13 "2015-11-06T17:40:47Z")
you are right. I had missed the \ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:23am UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995/14 "2017-07-06T05:23:36Z")