# Setting log time to @timestamp in logstash

**URL:** <https://discuss.elastic.co/t/setting-log-time-to-timestamp-in-logstash/186374>\
**Category:** Logstash\
**Created:** [June 19, 2019, 5:40am UTC](https://discuss.elastic.co/t/setting-log-time-to-timestamp-in-logstash/186374 "2019-06-19T05:40:24Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vinutha\_A\_H](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinutha_a_h/32/48343_2.png) [@Vinutha\_A\_H](https://discuss.elastic.co/u/Vinutha_A_H)\
**Post date:** [June 19, 2019, 5:40am UTC](https://discuss.elastic.co/t/setting-log-time-to-timestamp-in-logstash/186374/1 "2019-06-19T05:40:24Z")

</div>

Hi,

In our logs, we have our date time as below and trying to set the same to timestamp field in logstash. But it's giving dateparsefailure.

Any help in this is useful.

Logs : the below data is mapped as DateTime using grok filter.  
//  
MonJune10201909:36:58EDT

FriJune03201902:08:31BST  
//

Our logstash config has :  
//  
mutate { add\_field =\> ["ts" , "%{DateTime}"] }  
date {  
match =\> ["ts", "EMMMMddyyyyHH:mm:ssz"]  
target =\> "@timestamp"  
}  
//

---

<div class="post-metadata">

**Author:** ![Vinutha\_A\_H](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinutha_a_h/32/48343_2.png) [@Vinutha\_A\_H](https://discuss.elastic.co/u/Vinutha_A_H)\
**Post date:** [June 19, 2019, 5:05pm UTC](https://discuss.elastic.co/t/setting-log-time-to-timestamp-in-logstash/186374/2 "2019-06-19T17:05:33Z")

</div>

Hi,

Can someone please provide input / fix for this?

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [June 19, 2019, 5:18pm UTC](https://discuss.elastic.co/t/setting-log-time-to-timestamp-in-logstash/186374/3 "2019-06-19T17:18:39Z")

</div>

In your `date` filter, shouldn't your `match` pattern be as follows?

```
match => ["ts", "EEEMMMMddyyyyHH:mm:ssz"]

```

That should match the three-letter date abbreviation, rather than the one-character abbreviation your original pattern would match.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 19, 2019, 5:26pm UTC](https://discuss.elastic.co/t/setting-log-time-to-timestamp-in-logstash/186374/4 "2019-06-19T17:26:14Z")

</div>

> [@Vinutha\_A\_H](#):
>
> FriJune03201902:08:31BST

The first one parses just fine. This one gets a \_dateparsefailure because BST could be one of several different timezones. Use mutate+gsub to replace it with something unambiguous.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 19, 2019, 5:32pm UTC](https://discuss.elastic.co/t/setting-log-time-to-timestamp-in-logstash/186374/5 "2019-06-19T17:32:52Z")

</div>

> [@DougR](#):
>
> That should match the three-letter date abbreviation, rather than the one-character abbreviation your original pattern would match.

The logstash documentation implies, and experimentation confirms, that E, EE, and EEE all match three character abbreviations. I cannot find it in the Joda documentation.

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [June 19, 2019, 5:46pm UTC](https://discuss.elastic.co/t/setting-log-time-to-timestamp-in-logstash/186374/6 "2019-06-19T17:46:13Z")

</div>

> [@Badger](#):
>
> The logstash documentation implies, and experimentation confirms, that E, EE, and EEE all match three character abbreviations. I cannot find it in the Joda documentation.

I misread then. Thanks.

---

<div class="post-metadata">

**Author:** ![Vinutha\_A\_H](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinutha_a_h/32/48343_2.png) [@Vinutha\_A\_H](https://discuss.elastic.co/u/Vinutha_A_H)\
**Post date:** [June 20, 2019, 5:44am UTC](https://discuss.elastic.co/t/setting-log-time-to-timestamp-in-logstash/186374/7 "2019-06-20T05:44:52Z")

</div>

Thank you Badger for your input. Let me try replacing timezones using mutate+gsub.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2019, 5:45am UTC](https://discuss.elastic.co/t/setting-log-time-to-timestamp-in-logstash/186374/8 "2019-07-18T05:45:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.