(\d){4}-(\d){2}-(\d){2} (\d){2}:(\d){2}:(\d){2},(\d){3})"]
}
date {
match => ["sourcestamp" , "yyyy-MM-dd HH:mm:ss,SSS"]
target => "@timestamp"
timezone => "America/Chicago"
}
}
```
Any help would be appreciated. Thank you!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 26, 2021, 4:40pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file-with-two-different-formats/271264/2 "2021-04-26T16:40:48Z")
I would suggest using grok filters to determine which format you have, then use a dissect filter for each. Something like
```
grok {
match => { "message" => "^%{TIMESTAMP_ISO8601}" }
add_tag => ["startsWithTimestamp"]
}
if "startsWithTimestamp" in [tags] {
dissect { mapping => { "message" => "..." } }
}
grok {
match => { "message" => "^%{IPV4}" }
add_tag => ["startsWithIp"]
}
if "startsWithIp" in [tags] {
dissect { mapping => { "message" => "..." } }
}
mutate { remove_tag => ["_grokparsefailure"] }
```
The \_grokparsefailure will always get added for one or the other, so it conveys zero information, and you lose nothing by removing it.
---
### Author:  [@kommineni24](https://discuss.elastic.co/u/kommineni24)
#### Post date: [April 26, 2021, 5:25pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file-with-two-different-formats/271264/3 "2021-04-26T17:25:09Z")
Thanks @Badger for the reply.
**Log line startsWithTimestamp:**
```auto
2021-04-21 15:00:03 104.47.58.138 OutboundConnectionCommand SMTPSVC1 LWMAILVU1 - 25 BDAT - 10695+LAST 0 0 4 0 1969 SMTP - - - -
```
**Log line startsWithIp:**
```auto
10.67.200.249 - example.domain.com [22/Mar/2021:22:00:00 -0600] "RCPT -? TO: SMTP" 250 41
```
I have adjusted my filter like below:
```
filter {
if "beats_input_codec_plain_applied" in [tags] {
mutate {
remove_tag => ["beats_input_codec_plain_applied"]
}
}
grok {
match => { "message" => "^%{TIMESTAMP_ISO8601}" }
add_tag => ["startsWithTimestamp"]
}
if "startsWithTimestamp" in [tags] {
dissect { mapping => { "message" => "%{[@metadata][timestamp]} %{+[@metadata][timestamp]} %{}" } }
date { match => ["[@metadata][timestamp]", "yyyy-MM-dd HH:mm:ss" ] }
}
}
grok {
match => { "message" => "^%{IPV4}" }
add_tag => ["startsWithIp"]
}
if "startsWithIp" in [tags] {
dissect { mapping => { "message" => "%{ip} %{?-} %{hostname} %{[@metadata][timestamp]} %{+[@metadata][timestamp]} %{}" } }
date { match => ["[@metadata][timestamp]", "yyyy-MM-dd HH:mm:ss" ] }
}
}
mutate { remove_tag => ["_grokparsefailure"] }
```
Let me know if it looks good?
Also please let me know If I can do the above same by only using GROK filter as I dont want to disturb the exisitng GROK logic for other formats of logs
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 26, 2021, 5:42pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file-with-two-different-formats/271264/4 "2021-04-26T17:42:39Z")
> [@kommineni24](#):
>
> Also please let me know If I can do the above same by only using GROK filter
Yes. If the only thing you want to extract is the timestamp it would be something like
```
grok {
pattern_definitions => { "OTHER_TIMESTAMP" => "%{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{ISO8601_TIMEZONE}" }
match => { "message" => (^%{TIMESTAMP_ISO8601:[@metadata][timestamp]}|\[%{OTHER_TIMESTAMP:[@metadata][timestamp]})"
}
```
---
### Author:  [@kommineni24](https://discuss.elastic.co/u/kommineni24)
#### Post date: [April 26, 2021, 8:19pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file-with-two-different-formats/271264/5 "2021-04-26T20:19:18Z")
```auto
10.67.200.249 - name.company.com [22/Mar/2021:22:00:00 -0600] "RCPT -? TO: SMTP" 250 41
```
I am using the below dissect pattern for logline above
```auto
%{ip} %{?-} %{hostname} %{[@metadata][timestamp]} %{+[@metadata][timestamp]} %{}
```
I am able to print the values but my timestamp is coming in brackets, is there a way I can remove the brackets.
Attached output from dissect-tester.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 26, 2021, 8:25pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file-with-two-different-formats/271264/6 "2021-04-26T20:25:38Z")
> [@kommineni24](#):
>
> is there a way I can remove the brackets.
Use them as delimiters for dissect
```
%{ip} %{?-} %{hostname} [%{[@metadata][timestamp]}] %{}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 24, 2021, 8:26pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file-with-two-different-formats/271264/7 "2021-05-24T20:26:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.