# Timestamp format in logstash 1.5.6 **URL:** \ **Category:** Logstash\ **Created:** [March 23, 2017, 1:25pm UTC](https://discuss.elastic.co/t/timestamp-format-in-logstash-1-5-6/79755 "2017-03-23T13:25:52Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![manopmk](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@manopmk](https://discuss.elastic.co/u/manopmk)\ **Post date:** [March 23, 2017, 1:25pm UTC](https://discuss.elastic.co/t/timestamp-format-in-logstash-1-5-6/79755/1 "2017-03-23T13:25:52Z")
My log have this format **11-30-2016 12:13:57 INFO** - Mapped "{[/transaction/get-account-history],methods=[POST],params=[],headers=[],consumes=[],produces=[],custom=[]}" then how do i include timestamp format in filter ? my second query is i included path =\> ["/Users/tcstsb3/Downloads/log/\*.log"] contain many logs How to combine all logs and sort based on time In kibana i want to show like **Example :** 11-30-2016 12:13:57 INFO hello ....(from log1) 11-30-2016 12:13:57 INFO hai ..... (from log2) 11-30-2016 12:13:58 INFO msg .....(from log1) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 23, 2017, 1:36pm UTC](https://discuss.elastic.co/t/timestamp-format-in-logstash-1-5-6/79755/2 "2017-03-23T13:36:04Z")
> then how do i include timestamp format in filter ? Use a grok filter to extract the timestamp, loglevel, and possibly other pieces of the string into separate fields. Then use a date filter to parse the timestamp string into the `@timestamp` field. > How to combine all logs and sort based on time As long as your date filter works that's exactly how Kibana will behave. ---
**Author:** ![manopmk](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@manopmk](https://discuss.elastic.co/u/manopmk)\ **Post date:** [March 23, 2017, 1:40pm UTC](https://discuss.elastic.co/t/timestamp-format-in-logstash-1-5-6/79755/3 "2017-03-23T13:40:05Z")
Thank you so much buddy 🙂 i tried filter { ``` grok { match => { "message" => "%{COMBINEDAPACHELOG}" } } date { match => ["timestamp" , "MM-dd-yyyy HH:mm:ss Z"] } ``` } doesnt work correctly.. can you correct my format ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 23, 2017, 1:45pm UTC](https://discuss.elastic.co/t/timestamp-format-in-logstash-1-5-6/79755/4 "2017-03-23T13:45:04Z")
Your log isn't an Apache log so COMBINEDAPACHELOG obviously won't work. Perhaps the grok constructor web site can help you create a usable grok expression. ---
**Author:** ![manopmk](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@manopmk](https://discuss.elastic.co/u/manopmk)\ **Post date:** [March 23, 2017, 1:47pm UTC](https://discuss.elastic.co/t/timestamp-format-in-logstash-1-5-6/79755/5 "2017-03-23T13:47:21Z")
mine apache log only buddy just for sample i mentioned like 11-30-2016 12:13:57 INFO hello ....(from log1) 11-30-2016 12:13:57 INFO hai ..... (from log2) 11-30-2016 12:13:58 INFO msg .....(from log1) but im using apache log only how can i change my timestamp format so that it will sort based on timestamp ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 23, 2017, 1:52pm UTC](https://discuss.elastic.co/t/timestamp-format-in-logstash-1-5-6/79755/6 "2017-03-23T13:52:50Z")
The log examples you have shown aren't Apache combined logs so COMBINEDAPACHELOG won't work, period. ---
**Author:** ![manopmk](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@manopmk](https://discuss.elastic.co/u/manopmk)\ **Post date:** [March 23, 2017, 1:54pm UTC](https://discuss.elastic.co/t/timestamp-format-in-logstash-1-5-6/79755/7 "2017-03-23T13:54:09Z")
this my apache web server log only buddy **11-30-2016 12:13:57 INFO - Mapped "{[/transaction/get-account-history],methods=[POST],params=[],headers=[],consumes=[],produces=[],custom=[]}"** ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 23, 2017, 1:57pm UTC](https://discuss.elastic.co/t/timestamp-format-in-logstash-1-5-6/79755/8 "2017-03-23T13:57:49Z")
As I've already said: - That's not an Apache combined log. - The grok constructor web site can help you create a usable grok expression. Over and out. ---
**Author:** ![manopmk](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@manopmk](https://discuss.elastic.co/u/manopmk)\ **Post date:** [March 24, 2017, 6:02am UTC](https://discuss.elastic.co/t/timestamp-format-in-logstash-1-5-6/79755/9 "2017-03-24T06:02:30Z")
Thank you buddy, i removed that my msg like 11-30-2016 12:13:57 INFO... im trying to modify the timestamp of log filter { grok { match =\> ["message" , "MM-dd-YYYY HH:mm:ss"] } date { match =\> ["timestamp" , "MM-dd-YYYY HH:mm:ss"] target =\> "@timestamp" } } but json still showing like this "message" =\> "11-10-2016 12:13:57 INFO - FrameworkServlet 'dispatcher': initialization completed in 39 ms", "@version" =\> "1", "@timestamp" =\> " **2017-03-24T05:59:14.365Z**", "host" =\> "Vishnu-Prasad.local", "path" =\> "/Users/tcstsb3/Downloads/log/starbuck-batch.log", "tags" =\> [ [0] "\_grokparsefailure" ] timestamp format not changed .. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 21, 2017, 6:02am UTC](https://discuss.elastic.co/t/timestamp-format-in-logstash-1-5-6/79755/10 "2017-04-21T06:02:47Z")
Closed on April 21, 2017, 6:02am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.