# String to date time

**URL:** <https://discuss.elastic.co/t/string-to-date-time/57656>\
**Category:** Logstash\
**Created:** [August 10, 2016, 5:54am UTC](https://discuss.elastic.co/t/string-to-date-time/57656 "2016-08-10T05:54:51Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![vandana\_sethi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vandana_sethi/32/10894_2.png) [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)\
**Post date:** [August 10, 2016, 5:54am UTC](https://discuss.elastic.co/t/string-to-date-time/57656/1 "2016-08-10T05:54:51Z")

</div>

My log pattern is as  
|other|test|test1|20160808134300

i have chopped these pipe separated value in different fields and have fields like  
field0 = other  
field1 = test  
field2 = test1  
field3 = 20160808134300

field3 is time stamp of log 2016 08 08 13 43 00 I want to convert this field into date and time .

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 10, 2016, 6:03am UTC](https://discuss.elastic.co/t/string-to-date-time/57656/2 "2016-08-10T06:03:06Z")

</div>

Use the date filter.

---

<div class="post-metadata">

**Author:** ![vandana\_sethi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vandana_sethi/32/10894_2.png) [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)\
**Post date:** [August 10, 2016, 6:06am UTC](https://discuss.elastic.co/t/string-to-date-time/57656/3 "2016-08-10T06:06:28Z")

</div>

yeah I have gone for same I wrote this

```
date {
    match => ["field3", "MMM dd YYYY HH:mm:ss"]
  }

```

But I didn't find any change and some where I read that date accept array as input.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 10, 2016, 6:08am UTC](https://discuss.elastic.co/t/string-to-date-time/57656/4 "2016-08-10T06:08:13Z")

</div>

> ```
> match => ["field3", "MMM dd YYYY HH:mm:ss"]
> 
> ```

But that date pattern clearly doesn't match the contents of `field3`.

---

<div class="post-metadata">

**Author:** ![vandana\_sethi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vandana_sethi/32/10894_2.png) [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)\
**Post date:** [August 10, 2016, 6:10am UTC](https://discuss.elastic.co/t/string-to-date-time/57656/5 "2016-08-10T06:10:40Z")

</div>

so I need to write this ?

```
date {
    match => ["field3", "YYYYMMddHHmmss"]
  }
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 10, 2016, 6:16am UTC](https://discuss.elastic.co/t/string-to-date-time/57656/6 "2016-08-10T06:16:01Z")

</div>

Why don't you try it out?

---

<div class="post-metadata">

**Author:** ![vandana\_sethi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vandana_sethi/32/10894_2.png) [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)\
**Post date:** [August 10, 2016, 6:40am UTC](https://discuss.elastic.co/t/string-to-date-time/57656/7 "2016-08-10T06:40:32Z")

</div>

I tried

`match => ["field3", "YYYYMMddHHmmss"]`

but not working

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 10, 2016, 7:17am UTC](https://discuss.elastic.co/t/string-to-date-time/57656/8 "2016-08-10T07:17:40Z")

</div>

What's the error message in the log? The date filter always logs parse errors.

---

<div class="post-metadata">

**Author:** ![vandana\_sethi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vandana_sethi/32/10894_2.png) [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)\
**Post date:** [August 10, 2016, 8:24am UTC](https://discuss.elastic.co/t/string-to-date-time/57656/9 "2016-08-10T08:24:14Z")

</div>

There is no error message in logs.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 10, 2016, 9:06am UTC](https://discuss.elastic.co/t/string-to-date-time/57656/10 "2016-08-10T09:06:53Z")

</div>

Please show an example of an event as produced by a `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:44am UTC](https://discuss.elastic.co/t/string-to-date-time/57656/11 "2017-07-06T04:44:06Z")

</div>