# Timestamp is not parsing: grok

**URL:** <https://discuss.elastic.co/t/timestamp-is-not-parsing-grok/51188>\
**Category:** Logstash\
**Created:** [May 27, 2016, 6:40pm UTC](https://discuss.elastic.co/t/timestamp-is-not-parsing-grok/51188 "2016-05-27T18:40:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![shikha.agarwal1](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@shikha.agarwal1](https://discuss.elastic.co/u/shikha.agarwal1)\
**Post date:** [May 27, 2016, 6:40pm UTC](https://discuss.elastic.co/t/timestamp-is-not-parsing-grok/51188/1 "2016-05-27T18:40:18Z")

</div>

I have flat file(jobs.log) which has below data  
2016-05-25 17:52:11,467 [INFO] [main] [FileName.java:50] - Application: abc Rule: 123 Status: SUCCESS

I want log time stamp to show in kibana, so I am trying to replace @timestamp with log date time. I am using below config file  
input{  
# Read from flat file   
file{  
path =\> "\mypath\jobs.log"  
start\_position =\> beginning  
ignore\_older =\> 0  
}  
}  
filter{  
# check for patterns via grok plugin  
grok{  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:formattedDate}\* Application: %{DATA:applicationId} Rule: %{WORD:ruleName} Status: %{WORD:status}"}  
}  
#date{  
#match =\> ["formattedDate","YYYY-MM-dd HH:mm:ss,SSS", "ISO8601"]  
#locale =\> "en"  
#target =\> "@timestamp"  
#}  
}  
output{  
elasticsearch {}  
stdout { codec =\> rubydebug}  
}  
On my console formattedDate is not printing. Output is:  
{  
"message" =\> "2016-05-25 17:52:11,467 [INFO] [main] [FileName.java:50] - Application: abc Rule: 123 Status: SUCCESS",  
"@version" =\> "1",  
"@timestamp" =\> "2016-05-27T18:28:04.559Z",  
"path" =\> "\mypath\jobs.log",  
"host" =\> "hostName",  
"applicationId" =\> "abc",  
"ruleName" =\> "123",  
"status" =\> "SUCCESS"  
}

How can I get timestamp replaced with log file timestamp?

---

<div class="post-metadata">

**Author:** ![shikha.agarwal1](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@shikha.agarwal1](https://discuss.elastic.co/u/shikha.agarwal1)\
**Post date:** [May 27, 2016, 8:49pm UTC](https://discuss.elastic.co/t/timestamp-is-not-parsing-grok/51188/3 "2016-05-27T20:49:13Z")

</div>

Seems its not working. Its giving me same o/p.  
{  
"message" =\> "2016-05-25 17:52:11,467 [INFO] [main] [FileName.java:50] - Application: abc Rule: 123 Status: SUCCESS",  
"@version" =\> "1",  
"@timestamp" =\> "2016-05-27T20:46:07.723Z",  
"path" =\> "\jobs.log",  
"host" =\> "hostName",  
"applicationId" =\> "abc",  
"ruleName" =\> "123",  
"status" =\> "SUCCESS"  
}

Below screenshot from kibana

 ![](https://us1.discourse-cdn.com/elastic/original/2X/9/9c1678968de62f20fd676a2f1bf230e0ef9fe4a5.png)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 29, 2016, 11:52am UTC](https://discuss.elastic.co/t/timestamp-is-not-parsing-grok/51188/4 "2016-05-29T11:52:04Z")

</div>

You seem to think that `*` is a general wildcard character, but it actually means "zero or more occurrences of the previous token", so you're effectively making the timestamp optional. You can get the desired effect by replacing `*` with `.*`.

---

<div class="post-metadata">

**Author:** ![shikha.agarwal1](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@shikha.agarwal1](https://discuss.elastic.co/u/shikha.agarwal1)\
**Post date:** [May 31, 2016, 4:49pm UTC](https://discuss.elastic.co/t/timestamp-is-not-parsing-grok/51188/5 "2016-05-31T16:49:41Z")

</div>

Thanks!! It resolved my problem. I got one more question, I am able to get formatted date now but time is different by couple of hours. I am assuming this is problem with timezone. Can you please help me how to set it?  
Original timezone in logs is GMT format and my local system is set to UTC-7:00

O/P:  
"message" =\> "2016-05-25 17:52:11,467 [INFO] [main]  
"@version" =\> "1",  
"@timestamp" =\> "2016-05-26T00:52:11.467Z",  
"path" =\> "C:\Elastic\logs\jobs.log",  
"host" =\> "PHXDCJMP72",  
"formattedDate" =\> "2016-05-25 17:52:11,467",

filter:  
grok{  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:formattedDate}.\* Application: %{DATA:applicationId} Rule: %{WORD:ruleName} Status: %{WORD:status}"}  
}  
date{  
match =\> ["formattedDate", "YYYY-MM-dd HH:mm:ss,SSS","ISO8601"]  
target=\>"@timestamp"  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 31, 2016, 4:54pm UTC](https://discuss.elastic.co/t/timestamp-is-not-parsing-grok/51188/6 "2016-05-31T16:54:16Z")

</div>

If the log's timezone doesn't match the timezone of the machine running Logstash you can use the date filter's [`timezone` option](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-timezone) to override it.

---

<div class="post-metadata">

**Author:** ![shikha.agarwal1](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@shikha.agarwal1](https://discuss.elastic.co/u/shikha.agarwal1)\
**Post date:** [May 31, 2016, 5:10pm UTC](https://discuss.elastic.co/t/timestamp-is-not-parsing-grok/51188/7 "2016-05-31T17:10:53Z")

</div>

Working as expected now. Thank you for your help!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/timestamp-is-not-parsing-grok/51188/8 "2017-07-06T04:55:11Z")

</div>