# Timestamp processor - parsing milliseconds with comma

**URL:** <https://discuss.elastic.co/t/timestamp-processor-parsing-milliseconds-with-comma/225068>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 25, 2020, 8:56pm UTC](https://discuss.elastic.co/t/timestamp-processor-parsing-milliseconds-with-comma/225068 "2020-03-25T20:56:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dcamozzato](https://avatars.discourse-cdn.com/v4/letter/d/898d66/32.png) [@dcamozzato](https://discuss.elastic.co/u/dcamozzato)\
**Post date:** [March 25, 2020, 8:56pm UTC](https://discuss.elastic.co/t/timestamp-processor-parsing-milliseconds-with-comma/225068/1 "2020-03-25T20:56:28Z")

</div>

Hi,

I am trying to use Filebeat 7.5.1 to parse a timestamp with the following format: '2020-01-17 06:37:17,849'

My layout is this: '2006-01-02 15:04:05,999'

Unfortunately, the above does not work. According to Golang docs, I need to define milliseconds with a period (e.g., ".999"). Indeed, if I change both the sample and the layout to use a period, it works. I am [linking here the Go Playground](https://play.golang.org/p/1KFByeKFYCM) for this.

Is there a way to get the timestamp processor to do what I need it to do? If not, is there some other way to get around this? For example, I couldn't find a way to concatenate fields, otherwise I could possibly use a dissect processor to split the comma out, and then join the fields with a period in the middle.

Any help is appreciated.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 26, 2020, 8:44pm UTC](https://discuss.elastic.co/t/timestamp-processor-parsing-milliseconds-with-comma/225068/2 "2020-03-26T20:44:02Z")

</div>

The processor is pretty strict about the format of the fractional seconds. I've seen a few workarounds. What you mention with dissect would work. You could using the script processor in Beats to replace the comma with a period before running the timestamp processor.  
You could defer the timestamp parsing to LS or ES Ingest Node, both have a more flexible `date` processor.

```auto
- dissect:
    tokenizer: '%{ts} %{+ts} %{message}'
- script:
    lang: javascript
    source: >
      function process(evt) {
        var ts = evt.Get('dissect.ts').replace(',', '.');
        evt.Put('dissect.ts', ts);
      }
- timestamp:
    field: dissect.ts
    layouts:
      - 2006-01-02 15:04:05.999

```

which gets you

```auto
  {
    "@timestamp": "2020-01-02T16:13:14.123Z",
    "dissect": {
      "message": "my log",
      "ts": "2020-01-02 16:13:14.123"
    },
    "message": "2020-01-02 16:13:14,123 my log"
  }

```

---

<div class="post-metadata">

**Author:** ![dcamozzato](https://avatars.discourse-cdn.com/v4/letter/d/898d66/32.png) [@dcamozzato](https://discuss.elastic.co/u/dcamozzato)\
**Post date:** [March 27, 2020, 2:24pm UTC](https://discuss.elastic.co/t/timestamp-processor-parsing-milliseconds-with-comma/225068/3 "2020-03-27T14:24:13Z")

</div>

Andrew, that worked perfectly. Thank you so much for your assistance. I am not sure how I didn't see that "script" processor when I was looking for a solution, I will definitely keep it in mind from now on!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2020, 2:24pm UTC](https://discuss.elastic.co/t/timestamp-processor-parsing-milliseconds-with-comma/225068/4 "2020-04-24T14:24:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.