# Time field conversion

**URL:** <https://discuss.elastic.co/t/time-field-conversion/144542>\
**Category:** Logstash\
**Created:** [August 15, 2018, 3:52pm UTC](https://discuss.elastic.co/t/time-field-conversion/144542 "2018-08-15T15:52:07Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maddy\_M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddy_m/32/45638_2.png) [@Maddy\_M](https://discuss.elastic.co/u/Maddy_M)\
**Post date:** [August 15, 2018, 3:52pm UTC](https://discuss.elastic.co/t/time-field-conversion/144542/1 "2018-08-15T15:52:07Z")

</div>

Hi,

I have following line with timestamp and I am using grok filter, Could you please advise how to convert date into timestamp format?

Line:  
time=2018-08-15-09-33-57

grok filter expression  
{  
%{DATA:time}=%{YEAR}-%{MONTHNUM}-%{MONTHDAY}-%{HOUR}-%{MINUTE}-%{SECOND}  
}

Something like in ISO format,

mutate {  
add\_field =\> { "newtimestamp" =\> "%{MONTH} %{MONTHNUM} %{TIME}"}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 15, 2018, 3:57pm UTC](https://discuss.elastic.co/t/time-field-conversion/144542/2 "2018-08-15T15:57:56Z")

</div>

You don't need to use grok, you can parse that using a date filter.

```
date { match => ["message", "'time='YYYY-MM-dd-HH-mm-ss"] }
```

---

<div class="post-metadata">

**Author:** ![Maddy\_M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddy_m/32/45638_2.png) [@Maddy\_M](https://discuss.elastic.co/u/Maddy_M)\
**Post date:** [August 15, 2018, 4:00pm UTC](https://discuss.elastic.co/t/time-field-conversion/144542/3 "2018-08-15T16:00:48Z")

</div>

Thanks for your reply.

I have full line with other fields as below, so I am using grok and extracting fields. Any advise better to do this?

app\_name:Microexecution: metrics [time=2018-08-15-09-33-57, total\_qty=80, min=0, max=0]

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 15, 2018, 4:05pm UTC](https://discuss.elastic.co/t/time-field-conversion/144542/4 "2018-08-15T16:05:25Z")

</div>

> [@Maddy\_M](#):
>
> app\_name:Microexecution: metrics [time=2018-08-15-09-33-57, total\_qty=80, min=0, max=0]

I would parse that using

```
    grok { match => { "message" => "\[%{DATA:stuff}\]" } }
    kv { source => stuff field_split => ", " }
    date { match => ["time", "yyyy-MM-dd-HH-mm-ss"] }

```

---

<div class="post-metadata">

**Author:** ![Maddy\_M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddy_m/32/45638_2.png) [@Maddy\_M](https://discuss.elastic.co/u/Maddy_M)\
**Post date:** [August 15, 2018, 5:06pm UTC](https://discuss.elastic.co/t/time-field-conversion/144542/5 "2018-08-15T17:06:10Z")

</div>

Thanks that works!!

Lastly, I have four sets of lines, I am using filebeat to read lines from single file, but in log stash I would like to process and store metrics. I need to extract each field in each line and value next to it. Is there a generic way I can implement this or need to go line.

Lines:  
app\_name:Microexecution: metrics [time=2018-08-15-09-33-57, total\_qty=80, min=0, max=0]  
legacy\_name:profile: metrics [time=2018-08-15-09-33-57, total\_qty=80, min=0, max=0]  
external\_api:differed: metrics [total\_qty=80, min=0, max=0]  
leacy\_store:startpoling: metrics [total=50, min=0, max=0]

example output:  
{

{  
app\_name: Microexecution,  
time: 2018-08-15-09-33-57,  
total\_qty=80,  
min=0,  
max=0  
}  
{  
legacy\_name:profile,  
time=2018-08-15-09-33-57,  
total\_qty=80,  
min=0,  
max=0  
}  
{  
external\_api:differed,  
total\_qty=80,  
min=0,  
max=0  
}  
{  
leacy\_store:startpoling,  
total=50,  
min=0,  
max=0  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 12, 2018, 5:06pm UTC](https://discuss.elastic.co/t/time-field-conversion/144542/6 "2018-09-12T17:06:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.