# \[SOLVED\] Forcing a static year to date timestamps

**URL:** <https://discuss.elastic.co/t/solved-forcing-a-static-year-to-date-timestamps/40963>\
**Category:** Logstash\
**Created:** [February 4, 2016, 12:53pm UTC](https://discuss.elastic.co/t/solved-forcing-a-static-year-to-date-timestamps/40963 "2016-02-04T12:53:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![IGarvin](https://avatars.discourse-cdn.com/v4/letter/i/bbe5ce/32.png) [@IGarvin](https://discuss.elastic.co/u/IGarvin)\
**Post date:** [February 4, 2016, 12:53pm UTC](https://discuss.elastic.co/t/solved-forcing-a-static-year-to-date-timestamps/40963/1 "2016-02-04T12:53:40Z")

</div>

Hi,

I'm trying to take a timestamp from a log and force it to use the year 2015 since the log files do not originally include the year. Here's an example log entry:

`LOG: 06/02 15:24:03:643 1 Check for updates`

In my initial grok I do a %{TIMESTAMP:timestamp} which is a custom pattern of following:

`%{MONTHNUM2}\/%{MONTHDAY} %{TIME}`

I now need to add year to it. I've tried the following without success even though --config-test doesn't error:

```
	mutate {
		add_field => { "timestamp" => "2015 %{timestamp}" }
		}
	
	date {
		match => ["timestamp", "YYYY MM/dd HH:mm:ss:SSS"]
		}

```

Debug logs show it does not add the 2015 to the timestamp field:

`{:timestamp=>"2016-02-04T07:05:52.443000-0500", :message=>"Failed parsing date from field", :field=>"timestamp", :value=>"02/17 14:41:36:848", :exception=>"Invalid format: \"02/17 14:41:36:848\" is malformed at \"/17 14:41:36:848\"", :config_parsers=>"YYYY MM/dd HH:mm:ss:SSS", :config_locale=>"default=en_US", :level=>:warn}`

Any ideas? Thanks!

---

<div class="post-metadata">

**Author:** ![IGarvin](https://avatars.discourse-cdn.com/v4/letter/i/bbe5ce/32.png) [@IGarvin](https://discuss.elastic.co/u/IGarvin)\
**Post date:** [February 4, 2016, 12:56pm UTC](https://discuss.elastic.co/t/solved-forcing-a-static-year-to-date-timestamps/40963/2 "2016-02-04T12:56:58Z")

</div>

Btw, I want to add that the strange thing is that it does appear to be successful, and I see in Kibana the results that everything is forced 2015. However it still tags with grokparsefailure and dateparsefailure and it floods the logs.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 4, 2016, 8:07pm UTC](https://discuss.elastic.co/t/solved-forcing-a-static-year-to-date-timestamps/40963/3 "2016-02-04T20:07:20Z")

</div>

So what does the `timestamp` field look like? Output from `stdout { codec => rubydebug }` would be useful.

(I suspect the problem is that you're using `add_field` instead of `replace`.)

---

<div class="post-metadata">

**Author:** ![IGarvin](https://avatars.discourse-cdn.com/v4/letter/i/bbe5ce/32.png) [@IGarvin](https://discuss.elastic.co/u/IGarvin)\
**Post date:** [February 9, 2016, 1:36pm UTC](https://discuss.elastic.co/t/solved-forcing-a-static-year-to-date-timestamps/40963/4 "2016-02-09T13:36:09Z")

</div>

Gosh, not sure how I missed that one! Thanks! Did the trick just fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:12am UTC](https://discuss.elastic.co/t/solved-forcing-a-static-year-to-date-timestamps/40963/5 "2017-07-06T05:12:29Z")

</div>