# Time parsing in logstash

**URL:** <https://discuss.elastic.co/t/time-parsing-in-logstash/261199>\
**Category:** Logstash\
**Created:** [January 15, 2021, 2:48am UTC](https://discuss.elastic.co/t/time-parsing-in-logstash/261199 "2021-01-15T02:48:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![525125](https://avatars.discourse-cdn.com/v4/letter/5/7ea924/32.png) [@525125](https://discuss.elastic.co/u/525125)\
**Post date:** [January 15, 2021, 2:48am UTC](https://discuss.elastic.co/t/time-parsing-in-logstash/261199/1 "2021-01-15T02:48:29Z")

</div>

I need tp parse below log line and extract the time into @apptimestamp . It throughing date parse failure. We need use the filed in kibana. We need to get whole timestamp with timezone and AM/PM

log line:  
/start/scripts/transfer.sh Sun 15 Jul 2018 11:15:01 PM EDT files

Logstash config :

```auto
input { beats { port => 5045 } }
filter {
    if "tag7" in [kind] {

    grok { match => { "message" => "%{GREEDYDATA:script} %{DAY:weekday} %{MONTHDAY:day} %{MONTH:month} %{YEAR:year} %{TIME:time} %{WORD:period} %{WORD:zone} %{GREEDYDATA:logmessgae}" } }

  mutate {
         add_field => {
         "appTimestamp" => "%{weekday} %{day} %{month} %{year} %{time} %{period} %{zone}"
                                }

} 
   date {
        match => ["appTimestamp","EEE dd MMM yyyy hh:mm:ss a Z"]
        target => "@appTimestamp"
        remove_field => ["appTimestamp"]
        remove_field => ["month", "day", "year", "time","period"]
       }
   }
 
} 
output {
  stdout {
     codec => rubydebug
   }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 12, 2021, 2:48am UTC](https://discuss.elastic.co/t/time-parsing-in-logstash/261199/2 "2021-02-12T02:48:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.