# Timestamp replacing with format MMM dd HH:mm:ss yyyy
**URL:** https://discuss.elastic.co/t/timestamp-replacing-with-format-mmm-dd-hhss-yyyy/151368
**Category:** Logstash
**Created:** [October 7, 2018, 6:47pm UTC](https://discuss.elastic.co/t/timestamp-replacing-with-format-mmm-dd-hhss-yyyy/151368 "2018-10-07T18:47:34Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@calebereis](https://discuss.elastic.co/u/calebereis)
#### Post date: [October 7, 2018, 6:47pm UTC](https://discuss.elastic.co/t/timestamp-replacing-with-format-mmm-dd-hhss-yyyy/151368/1 "2018-10-07T18:47:34Z")
Hi, I'm Calebe and I'm trying to replace the timestamp with the timestamp from the log file.
I tried so many things and nothing works.
I have this kind of timestamp in my log file:
Jun 24 19:34:54 2016
The problem is that I don't know the correct configure for grok filter.
I'm using this:
filter {
grok {
match =\> ["message" =\> %{SYSLOGBASE:timedate}]
}
date {
match =\> ["timedate" , "MMM dd HH:mm:ss yyyy"]
}
}
It's not working. I think that's because grok is configured wrong, but I can't find the right way.
Could anyone please help me?
---
### Author:  [@calebereis](https://discuss.elastic.co/u/calebereis)
#### Post date: [October 7, 2018, 6:55pm UTC](https://discuss.elastic.co/t/timestamp-replacing-with-format-mmm-dd-hhss-yyyy/151368/2 "2018-10-07T18:55:16Z")
I tride this different way and didn't work either.
filter {
grok {
match =\> ["message" =\> "^(?%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{YEAR:year})"]
add\_field =\> {"timestamp" =\> "%{day}-%{month}-%{year} %{time}"}
remove\_field =\> ["day", "month", "year", "time"]
}
date {
match =\> ["timestamp" , "MMM dd HH:mm:ss yyyy"]
remove\_field =\> "timestamp"
}
}
---
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [October 8, 2018, 8:10am UTC](https://discuss.elastic.co/t/timestamp-replacing-with-format-mmm-dd-hhss-yyyy/151368/3 "2018-10-08T08:10:23Z")
@calebereis,
The SYSLOGBASE will add another filed and you can use that filed to check the date and time when that log was generated at source machine.
Try the below config:
```auto
filter {
grok {
match => { "message" => ["SYSLOGBASE"] }
}
}
```
It will add a filed with name SYSLOGTIMESTAMP on kibana. You can refer that filed.
Thanks.
---
### Author:  [@calebereis](https://discuss.elastic.co/u/calebereis)
#### Post date: [October 8, 2018, 1:14pm UTC](https://discuss.elastic.co/t/timestamp-replacing-with-format-mmm-dd-hhss-yyyy/151368/4 "2018-10-08T13:14:24Z")
Hi Tek,
I tried doing that, but I got \_grokparsefailure.
Should I add the date filter refering to this new field?
---
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [October 9, 2018, 3:24am UTC](https://discuss.elastic.co/t/timestamp-replacing-with-format-mmm-dd-hhss-yyyy/151368/5 "2018-10-09T03:24:23Z")
@Calebereis, Can you please provide the output or error log?
That will be helpful to troubleshoot the issue.
Thanks.
---
### Author:  [@calebereis](https://discuss.elastic.co/u/calebereis)
#### Post date: [October 9, 2018, 11:09am UTC](https://discuss.elastic.co/t/timestamp-replacing-with-format-mmm-dd-hhss-yyyy/151368/6 "2018-10-09T11:09:03Z")
After so many tries, I found something that works.
```
filter {
grok {
match => { "message" => "^%{MONTH:mes}\s*%{MONTHDAY:dia}\s*%{TIME:hora}\s*%{YEAR:ano}:\s.*%{IP:ip}" }
}
mutate {
add_field => {
"timedate" => "%{mes} %{dia} %{hora} %{ano}"
}
}
}
```
And now I can receive my txt file and read it in the right time.
Thank you anyway, Tek.
Hope it helps someone else.
---
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [October 9, 2018, 11:12am UTC](https://discuss.elastic.co/t/timestamp-replacing-with-format-mmm-dd-hhss-yyyy/151368/7 "2018-10-09T11:12:26Z")
@calebereis, Glad to hear that. 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 6, 2018, 11:20am UTC](https://discuss.elastic.co/t/timestamp-replacing-with-format-mmm-dd-hhss-yyyy/151368/8 "2018-11-06T11:20:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.