# Unable to get Date Time from logs into Timestamp

**URL:** <https://discuss.elastic.co/t/unable-to-get-date-time-from-logs-into-timestamp/243467>\
**Category:** Logstash\
**Created:** [August 2, 2020, 4:45pm UTC](https://discuss.elastic.co/t/unable-to-get-date-time-from-logs-into-timestamp/243467 "2020-08-02T16:45:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JonnB](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@JonnB](https://discuss.elastic.co/u/JonnB)\
**Post date:** [August 2, 2020, 4:45pm UTC](https://discuss.elastic.co/t/unable-to-get-date-time-from-logs-into-timestamp/243467/1 "2020-08-02T16:45:19Z")

</div>

Hi,

I have gone through previous posts which do not seem to help with my specific issue and its taking a long time to figure out without progress, if you can assist in the group?

I want to get the datetime from my logfile into the timestamp field, an example of the log time is below:

Example Logfile date time format: 20200723T093645+0000

This is my logstash config file which works fine (apart from date issue):

```auto
input {
  beats {
    port => 5044
    type => logs
  }
}

filter {
   grok {
      match => { "message" => "%{YEAR:year}%{MONTHNUM:month}%{MONTHDAY:day}T%{HOUR:hour}:?%{MINUTE:minute}(?::?%{SECOND:second})?%{ISO8601_TIMEZONE}%{SPACE}%{NOTSPACE:Logtype}%{SPACE} " }
   }

  # Note: if i try to add T between day and hour i get an error

   mutate {
     add_field => { "timestamp" => "%{year}-%{month}-%{day} %{hour}:%{minute}:%{second}" }
   }

    date {  
      match => ["timestamp", "yyyy-MM-dd HH:mm:ss.SSSSSS"]
      target => "@timestamp"
      locale => "en"
      #remove_field => ["timestamp"]
    }

}

output {
  if [type] == "logs" {
    elasticsearch { 
      hosts => ["http://192.168.1.56:9200"] 
      index => "logstash-logs-%{+YYYY.MM.dd}"
    }
  }
}

```

I really do not know what i am doing having gone round in circles so hoping someone get get me past this please

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 2, 2020, 5:09pm UTC](https://discuss.elastic.co/t/unable-to-get-date-time-from-logs-into-timestamp/243467/2 "2020-08-02T17:09:53Z")

</div>

> [@JonnB](#):
>
> `match => ["timestamp", "yyyy-MM-dd HH:mm:ss.SSSSSS"]`

Remove the .SSSSSS from the pattern. Your timestamp does not have sub-second precision.

That said, I think you are making this way harder than it needs to be. If you changed your grok to use

```
match => { "message" => "^%{NOTSPACE:timestamp}%{SPACE}%{NOTSPACE:Logtype}%{SPACE} " }

```

you could match it using

```
match => ["timestamp", "yyyyMMdd'T'HHmmssZ"]

```

---

<div class="post-metadata">

**Author:** ![JonnB](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@JonnB](https://discuss.elastic.co/u/JonnB)\
**Post date:** [August 2, 2020, 6:00pm UTC](https://discuss.elastic.co/t/unable-to-get-date-time-from-logs-into-timestamp/243467/3 "2020-08-02T18:00:16Z")

</div>

Thanks Badger, that was a copy and paste answer! 😄

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2020, 6:00pm UTC](https://discuss.elastic.co/t/unable-to-get-date-time-from-logs-into-timestamp/243467/4 "2020-08-30T18:00:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.