# Setting @timestamp once MM YYYY etc are parsed

**URL:** <https://discuss.elastic.co/t/setting-timestamp-once-mm-yyyy-etc-are-parsed/155029>\
**Category:** Logstash\
**Created:** [November 1, 2018, 2:07pm UTC](https://discuss.elastic.co/t/setting-timestamp-once-mm-yyyy-etc-are-parsed/155029 "2018-11-01T14:07:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![P\_Larsen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/p_larsen/32/40097_2.png) [@P\_Larsen](https://discuss.elastic.co/u/P_Larsen)\
**Post date:** [November 1, 2018, 2:07pm UTC](https://discuss.elastic.co/t/setting-timestamp-once-mm-yyyy-etc-are-parsed/155029/1 "2018-11-01T14:07:19Z")

</div>

I am able to grok out MM YYYY etc, the part I can't get a handle on is the logstash conf files for non-standard time formats and setting @timestamp

Sample log  
\ Nov 01 2018 07:42:25: %ASA-6-106100: access-list global-in permitted tcp outside/333.33.33.33(28923)

\ filter{  
\ grok {  
\ match =\> ["message","%{MONTH:MMM} %{MONTHDAY:dd} %{YEAR:YYYY} %{HOUR:HH}:%{MINUTE:mm}:%{SECOND:ss}: ?%{GREEDYDATA:message}"]  
\}

Sample Std-in to Std-out Test

Nov 01 2018 07:42:25: %ASA-6-106100: access-list global-in permitted tcp outside/333.33.33.33(28923)  
{  
"@version" =\> "1",  
"host" =\> "hosta",  
"MMM" =\> "Nov",  
"ss" =\> "25",  
"message" =\> [  
[0] "Nov 01 2018 07:42:25: %ASA-6-106100: access-list global-in permitted tcp outside/180.163.220.124(28923)",  
[1] "%ASA-6-106100: access-list global-in permitted tcp outside/333.33.33.33(28923)"  
],  
"@timestamp" =\> 2018-11-01T13:40:15.984Z,  
"dd" =\> "01",  
"mm" =\> "42",  
"YYYY" =\> "2018",  
"HH" =\> "07"  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 29, 2018, 2:07pm UTC](https://discuss.elastic.co/t/setting-timestamp-once-mm-yyyy-etc-are-parsed/155029/2 "2018-11-29T14:07:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.