# Syslog date without year
**URL:** https://discuss.elastic.co/t/syslog-date-without-year/29834
**Category:** Logstash
**Created:** [September 23, 2015, 11:10am UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834 "2015-09-23T11:10:34Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Miguel\_Bessa](https://discuss.elastic.co/u/Miguel_Bessa)
#### Post date: [September 23, 2015, 11:10am UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834/1 "2015-09-23T11:10:34Z")
Hi,
I'm using Logstash to analyze my syslog files. My syslog files have the date like this: Jun 30 06:34:35.
I want have the year to, because I need to use date to filter visualizations on kibana.
I don't use kibana @timestamp because the syslog data are upload just when I need and @timestamp it's different of each syslog date.
How can I do this?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 23, 2015, 11:16am UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834/2 "2015-09-23T11:16:28Z")
Sorry, I don't understand why you can't use `@timestamp`. The date filter will use the year when the Logstash process started as the default year when date being parsed doesn't contain a year. Are you saying that you're not pushing logs to Elasticsearch continuously but import data in batches as needed?
---
### Author:  [@Miguel\_Bessa](https://discuss.elastic.co/u/Miguel_Bessa)
#### Post date: [September 23, 2015, 11:28am UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834/3 "2015-09-23T11:28:18Z")
Exactly, I don't use continualy but I push the files when I need. Because of this I don't use @timestamp.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 23, 2015, 12:29pm UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834/4 "2015-09-23T12:29:08Z")
Okay, but that doesn't make sense. With Logstash one normally uses the date filter to populate the `@timestamp` field with the time that the event occurred.
Either way having a logfile without year information is problematic, _especially_ when you batch-process old files. Assuming you process log files within a year, perhaps you can use a ruby filter to compare the current time with the month and day from the log entry and choose the correct year based on that.
---
### Author:  [@Miguel\_Bessa](https://discuss.elastic.co/u/Miguel_Bessa)
#### Post date: [September 23, 2015, 1:16pm UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834/5 "2015-09-23T13:16:01Z")
OK, i will try, thanks for help me!
Best regards.
---
### Author:  [@Miguel\_Bessa](https://discuss.elastic.co/u/Miguel_Bessa)
#### Post date: [September 23, 2015, 3:03pm UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834/6 "2015-09-23T15:03:16Z")
How can I convert string to date?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 23, 2015, 5:13pm UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834/7 "2015-09-23T17:13:36Z")
Use the [date filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html). If you're writing Ruby code for a ruby filter you'll have to look into Ruby's date and time functions.
---
### Author:  [@Miguel\_Bessa](https://discuss.elastic.co/u/Miguel_Bessa)
#### Post date: [September 24, 2015, 8:06am UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834/8 "2015-09-24T08:06:28Z")
Ok I will try, thanks for help again.
---
### Author:  [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)
#### Post date: [January 29, 2016, 1:55am UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834/9 "2016-01-29T01:55:06Z")
I am following this thread : [http://stackoverflow.com/questions/29384754/syslog-timestamp-without-year](http://stackoverflow.com/questions/29384754/syslog-timestamp-without-year)
My requirement is :
If syslog message comes with year in timestamp, I should match in date filter and take that year as time and put it in elasticsearch, If there is not year in syslog timestamp, then I need to have some default year / some default value which I will know in future, How can I do that ?
My date filter is :
date {
target =\> "@timestamp"
match =\> [ "syslog\_timestamp",
"MMM d HH:mm:ss YYYY",
"MMM dd HH:mm:ss YYYY" ]
timezone =\> "UTC"
}
Here If syslog\_timestamp does not contains year then this fails.
---
### Author:  [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)
#### Post date: [February 1, 2016, 7:11pm UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834/10 "2016-02-01T19:11:53Z")
Any reply on this one ?
---
### Author:  [@Miguel\_Bessa](https://discuss.elastic.co/u/Miguel_Bessa)
#### Post date: [February 3, 2016, 11:47am UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834/11 "2016-02-03T11:47:27Z")
Hi,
In your message if you don't have year, you can force a year.
E.g.:
filter {
mutate {
replace =\> ["timestamp", "%{timestamp} 2014"]
}
date {
locale =\> "en"
match =\> ["timestamp",
"MMM d HH:mm:ss YYYY",
"MMM dd HH:mm:ss YYYY",
"ISO8601"]
}
}
PS: Magnus Black answer in: [http://stackoverflow.com/questions/29384754/syslog-timestamp-without-year](http://stackoverflow.com/questions/29384754/syslog-timestamp-without-year)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:13am UTC](https://discuss.elastic.co/t/syslog-date-without-year/29834/12 "2017-07-06T05:13:14Z")