# Syslog timestamp format?

**URL:** https://discuss.elastic.co/t/syslog-timestamp-format/49007
**Category:** Logstash
**Created:** [May 3, 2016, 1:26am UTC](https://discuss.elastic.co/t/syslog-timestamp-format/49007 "2016-05-03T01:26:48Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![stefansaye](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@stefansaye](https://discuss.elastic.co/u/stefansaye)
#### Post date: [May 3, 2016, 1:26am UTC](https://discuss.elastic.co/t/syslog-timestamp-format/49007/1 "2016-05-03T01:26:48Z")

</div>

I am using logs from syslog, and syslog timestamp format doest not have year, and the timestamp format is

```
May 3 09:10:10

```

how to add the year and convert the format to

YYYY-MM-DD hh:mm:ss  
for the example ,it's will be looks like

```
2016-05-03 09:00:10

```

Any help is welcome to resolve this.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 3, 2016, 4:23am UTC](https://discuss.elastic.co/t/syslog-timestamp-format/49007/2 "2016-05-03T04:23:17Z")

</div>

You need to use the date filter - [https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html)  
A match pattern like `MMM dd HH:mm:ss` would work, then when you integrate that into the filter it'll add the date and make it ISO8601 format.

---

<div class="post-metadata">

### Author: ![stefansaye](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@stefansaye](https://discuss.elastic.co/u/stefansaye)
#### Post date: [May 3, 2016, 6:07am UTC](https://discuss.elastic.co/t/syslog-timestamp-format/49007/3 "2016-05-03T06:07:11Z")

</div>

i tried to add the date filter

```
date {
   locale => "en"
   match => ["received_at",
          "MMM d HH:mm:ss YYYY",
          "MMM dd HH:mm:ss YYYY","ISO8601"
          ]
    add_field => ["time" , "%{YYYY-MM-dd HH:mm:ss}" ---> how to get the receive_at and convert the format ?
 }
```

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 3, 2016, 9:11pm UTC](https://discuss.elastic.co/t/syslog-timestamp-format/49007/4 "2016-05-03T21:11:06Z")

</div>

And what was the outcome?

---

<div class="post-metadata">

### Author: ![stefansaye](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@stefansaye](https://discuss.elastic.co/u/stefansaye)
#### Post date: [May 4, 2016, 3:52am UTC](https://discuss.elastic.co/t/syslog-timestamp-format/49007/5 "2016-05-04T03:52:46Z")

</div>

with my date filter

```
date {
         locale => "en"
         match => ["timestamp",
          "MMM d HH:mm:ss.SSS YYYY",
          "MMM dd HH:mm:ss.SSS YYYY",
          "ISO8601"]
    }

```

it's didn't get any error  
but the timestamp didn't convert the format  
from

```
May 4 11:49:19.701 2016

```

to

```
 2016-05-04 11:43:19.701
```

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 4, 2016, 4:05am UTC](https://discuss.elastic.co/t/syslog-timestamp-format/49007/6 "2016-05-04T04:05:19Z")

</div>

The date filter by default populates the `@timestamp` field with the parsed date, and does not update the field that was parsed. You can change this by specifying a target field.

---

<div class="post-metadata">

### Author: ![stefansaye](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@stefansaye](https://discuss.elastic.co/u/stefansaye)
#### Post date: [May 4, 2016, 6:21am UTC](https://discuss.elastic.co/t/syslog-timestamp-format/49007/7 "2016-05-04T06:21:14Z")

</div>

it's work when change the target field,  
but i just want to change the month format from Jan,Feb,Mar... to 01,02,03...

---

<div class="post-metadata">

### Author: ![shivkumar](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@shivkumar](https://discuss.elastic.co/u/shivkumar)
#### Post date: [May 11, 2017, 12:34pm UTC](https://discuss.elastic.co/t/syslog-timestamp-format/49007/8 "2017-05-11T12:34:07Z")

</div>

Could you please just provide the final configuration which you used to solve this issue.  
Since I am facing the same problem and I am not able to solve this

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:26am UTC](https://discuss.elastic.co/t/syslog-timestamp-format/49007/9 "2017-07-06T04:26:40Z")

</div>


