# Timestamp - cant figure out

**URL:** <https://discuss.elastic.co/t/timestamp-cant-figure-out/87845>\
**Category:** Logstash\
**Created:** [June 1, 2017, 5:59am UTC](https://discuss.elastic.co/t/timestamp-cant-figure-out/87845 "2017-06-01T05:59:05Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![punit\_j](https://avatars.discourse-cdn.com/v4/letter/p/a87d85/32.png) [@punit\_j](https://discuss.elastic.co/u/punit_j)\
**Post date:** [June 1, 2017, 5:59am UTC](https://discuss.elastic.co/t/timestamp-cant-figure-out/87845/1 "2017-06-01T05:59:05Z")

</div>

Hi ,  
I have a web log entry like below:

JINK|Information|0|05-17-2017 16:00:44:56|[JNK]|GET|/Services/portal/v1/CheckToken|End|System.Web.Http.Action|ReflectedHttpActionDescriptor.ExecuteAsync()|Action returned 'True'|26

I am not sure what timestamp this represents. 05-17-2017 16:00:44:56. To me looks like millisecond in the end. How do i convert it to @timestamp ? Should i be using below construct ?

match =\> ["logtimestamp", "MM-dd-yyyy hh:mm:ss:SSS"]

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 1, 2017, 7:46am UTC](https://discuss.elastic.co/t/timestamp-cant-figure-out/87845/2 "2017-06-01T07:46:36Z")

</div>

Probably, but it's hard for us to know for sure what your log files mean. But use "HH" for the hours, not "hh".

---

<div class="post-metadata">

**Author:** ![punit\_j](https://avatars.discourse-cdn.com/v4/letter/p/a87d85/32.png) [@punit\_j](https://discuss.elastic.co/u/punit_j)\
**Post date:** [June 1, 2017, 10:13am UTC](https://discuss.elastic.co/t/timestamp-cant-figure-out/87845/3 "2017-06-01T10:13:28Z")

</div>

Hi Magnus,

I am getting below error in elasticsearch log server on import:

Caused by: java.lang.IllegalArgumentException: Invalid format: "05-17-2017 16:10:09:76" is malformed at "-17-2017 16:10:09:76"  
at org.joda.time.format.DateTimeParserBucket.doParseMillis(DateTimeParserBucket.java:187) ~[joda-time-2.9.5.jar:2.9.5]  
at org.joda.time.format.DateTimeFormatter.parseMillis(DateTimeFormatter.java:826) ~[joda-time-2.9.5.jar:2.9.5]  
at org.elasticsearch.index.mapper.DateFieldMapper$DateFieldType.parse(DateFieldMapper.java:243) ~[elasticsearch-5.4.0.jar:5.4.0]  
at org.elasticsearch.index.mapper.DateFieldMapper.parseCreateField(DateFieldMapper.java:468) ~[elasticsearch-5.4.0.jar:5.4.0]

seems there is problem in date parser. I tried with HH as well, still same issue.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 1, 2017, 1:16pm UTC](https://discuss.elastic.co/t/timestamp-cant-figure-out/87845/4 "2017-06-01T13:16:05Z")

</div>

Works fine for me:

```nohighlight
$ cat test.config 
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
  date {
    match => ["message", "MM-dd-yyyy HH:mm:ss:SSS"]
  }
}
$ echo '05-17-2017 16:00:44:56' | /opt/logstash/bin/logstash -f test.config
Settings: Default pipeline workers: 8
Pipeline main started
{
       "message" => "05-17-2017 16:00:44:56",
      "@version" => "1",
    "@timestamp" => "2017-05-17T14:00:44.560Z",
          "host" => "lnxolofon"
}
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}

```

Just note that Logstash doesn't parse the milliseconds correctly. I'm not sure why.

---

<div class="post-metadata">

**Author:** ![punit\_j](https://avatars.discourse-cdn.com/v4/letter/p/a87d85/32.png) [@punit\_j](https://discuss.elastic.co/u/punit_j)\
**Post date:** [June 1, 2017, 3:13pm UTC](https://discuss.elastic.co/t/timestamp-cant-figure-out/87845/5 "2017-06-01T15:13:17Z")

</div>

Thanks for the test magnus.  
Is this a known issue ?  
Is there a way around or do you suggest dropping milliseconds ?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 1, 2017, 4:07pm UTC](https://discuss.elastic.co/t/timestamp-cant-figure-out/87845/6 "2017-06-01T16:07:56Z")

</div>

What version of Logstash are you using? Are you using a date filter like in the example Magnus provided? What does an event look like if you output it to stdout with a rubydebug codec?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 29, 2017, 4:08pm UTC](https://discuss.elastic.co/t/timestamp-cant-figure-out/87845/7 "2017-06-29T16:08:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.