["WL_LOGS"]
uppercase => ["severity"]
}
multiline {
patterns_dir => "/users/mpswrk1/LogStash/impls/patterns/patterns"
pattern => "^\<%{WEBLOGICTIMESTAMP} "
negate => true
what => "previous"
}
grok {
match => { "message" => "\<%{WEBLOGICTIMESTAMP} %{WORD}\> \<%{LOGLEVEL:severity}\> \<%{DATA:module}\> \<%{DATA:error_code}\> \<%{DATA:error_message}\>" }
patterns_dir => "/users/mpswrk1/LogStash/impls/patterns/patterns"
}
date {
match => ["timestamp" , "MMM dd, yyyy HH:mm:ss"]
#match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
}
```
\*WEBLOGICTIMESTAMP is a private pattern I set:
```
WEBLOGICTIMESTAMP %{MONTH} %{MONTHDAY}, %{YEAR} %{TIME} %{DL}
DL ([P|A]M]?)
```
I am trying to get the `Mar 1, 2016 1:54:15 PM IST` which is represent by`%{WEBLOGICTIMESTAMP} %{WORD}` in the grok, as the timestamp. In this way I will have in the timestamp exactly the time the message occurs and not when it was load to elasticsearch.
Thanks
Sharon.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 4, 2016, 7:21pm UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956/2 "2016-12-04T19:21:55Z")
Please edit your post and mark your example log entry as preformatted text (there's a toolbar button for it). If you look at what you actually posted you'll note that it's not the same as what's in your log.
So what happens? Is the grok filter failing, leaving you with a `_grokparsefailure` tag to each event?
---
### Author:  [@ssasporta](https://discuss.elastic.co/u/ssasporta)
#### Post date: [December 4, 2016, 8:08pm UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956/3 "2016-12-04T20:08:38Z")
I edited my post again.
Regards
Sharon
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 4, 2016, 8:10pm UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956/4 "2016-12-04T20:10:21Z")
Please answer the question in my second paragraph too. The result of a `stdout { codec => rubydebug }` output would be useful.
---
### Author:  [@ssasporta](https://discuss.elastic.co/u/ssasporta)
#### Post date: [December 4, 2016, 8:12pm UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956/5 "2016-12-04T20:12:24Z")
The grok filter isn't failing, but I am getting as timestamp the time when the doc inserted to elastic. It affects my results in monitoring.
Thanks
Sharon.
---
### Author:  [@ssasporta](https://discuss.elastic.co/u/ssasporta)
#### Post date: [December 4, 2016, 8:13pm UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956/6 "2016-12-04T20:13:48Z")
> [@magnusbaeck](#):
>
> stdout { codec =\> rubydebug } output would be useful.
You mean to add this to my output and rerun?
Thanks
Sharon
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 4, 2016, 8:16pm UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956/7 "2016-12-04T20:16:01Z")
> The grok filter isn't failing, but I am getting as timestamp the time when the doc inserted to elastic. It affects my results in monitoring.
You're not capturing the timestamp into a field. Change `%{WEBLOGICTIMESTAMP}` to `%{WEBLOGICTIMESTAMP:timestamp}`. If it still doesn't work, look in your logs for clues. If the date filter fails it'll indicate why.
> You mean to add this to my output and rerun?
Yes.
---
### Author:  [@ssasporta](https://discuss.elastic.co/u/ssasporta)
#### Post date: [December 4, 2016, 8:18pm UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956/8 "2016-12-04T20:18:36Z")
great. I will try it and let you know.
Sharon.
---
### Author:  [@ssasporta](https://discuss.elastic.co/u/ssasporta)
#### Post date: [December 4, 2016, 8:38pm UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956/9 "2016-12-04T20:38:43Z")
It looks much better now. I have a field named **timestamp** and the data is there. but I have a t next to it and not a 'clock' like next to `@timestamp`. It means that the field is understood as a term and not as a timestamp. Right? I want to use that field as timestamp for my X axis line.
In the following example : [https://www.elastic.co/guide/en/logstash/current/config-examples.html](https://www.elastic.co/guide/en/logstash/current/config-examples.html) I see both @timestamp and timestamp fields were updated with the same value. This is also the results I want to have.
Anyway, I also can't find logs in my logstash log directory. I assume something wrong in my configuration.
[root@eaasrt log]# cd logstash/
[root@eaasrt logstash]# ll
total 0
Thanks
Sharon.
---
### Author:  [@ssasporta](https://discuss.elastic.co/u/ssasporta)
#### Post date: [December 4, 2016, 8:48pm UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956/10 "2016-12-04T20:48:08Z")
I see that on the stdout:
```
Failed parsing date from field {:field=>"timestamp", :value=>"Feb 28, 2016 3:25:46 AM", :exception=>"Invalid format: \"Feb 28, 2016 3:25:46 AM\" is malformed at \" AM\"", :config_parsers=>"MMM dd, yyyy HH:mm:ss", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"timestamp", :value=>"Feb 28, 2016 6:55:44 AM", :exception=>"Invalid format: \"Feb 28, 2016 6:55:44 AM\" is malformed at \" AM\"", :config_parsers=>"MMM dd, yyyy HH:mm:ss", :config_locale=>"default=en_US", :level=>:warn}
{
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 4, 2016, 9:11pm UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956/11 "2016-12-04T21:11:19Z")
You need to include "aa" at the end of you date pattern to recognize AM or PM. Also, change HH for the hours to hh since the timestamp has 12-hour days. I'd expect "MMM dd, yyyy hh:mm:ss aa" to work.
> Anyway, I also can't find logs in my logstash log directory. I assume something wrong in my configuration.
The location of the Logstash logs depends on how you invoke Logstash.
---
### Author:  [@ssasporta](https://discuss.elastic.co/u/ssasporta)
#### Post date: [December 5, 2016, 10:24am UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956/12 "2016-12-05T10:24:27Z")
It worked!
Thanks
Sharon.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 2, 2017, 10:24am UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956/13 "2017-01-02T10:24:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.