# Uniform Time Formats

**URL:** <https://discuss.elastic.co/t/uniform-time-formats/192678>\
**Category:** Logstash\
**Created:** [July 29, 2019, 10:46am UTC](https://discuss.elastic.co/t/uniform-time-formats/192678 "2019-07-29T10:46:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mvenkat\_in](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\
**Post date:** [July 29, 2019, 10:46am UTC](https://discuss.elastic.co/t/uniform-time-formats/192678/1 "2019-07-29T10:46:23Z")

</div>

I have the following 2 fields with different formats in the input.

End Time: 2019-07-26 00:00:05,580  
Start Time: 2019-07-26T00:00:02.678+02:100:

I want them to be formatted to a uniform timestamp say YYYY-MM-dd HH:mm:ss,SSS.

The objective is to to have uniform format and also to calculate the time difference in milli seconds.

Kindly suggest.

Thanks

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [July 29, 2019, 11:17am UTC](https://discuss.elastic.co/t/uniform-time-formats/192678/2 "2019-07-29T11:17:43Z")

</div>

you can use the date filter for that  
[https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-date.html)

You would have to build a parsing pattern for match. e.g. "yyyy-MM-dd HH:mm:ss,SSS" for the first pattern

example if the format is different in the same field:

```auto
date {
  match => ["<fieldname>", "<format1>", "<format2>"]
  target => "<fieldname where it should be a UTC timstamp>"
}

```

---

<div class="post-metadata">

**Author:** ![mvenkat\_in](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\
**Post date:** [July 29, 2019, 12:28pm UTC](https://discuss.elastic.co/t/uniform-time-formats/192678/3 "2019-07-29T12:28:31Z")

</div>

Can you please suggest what should be the pattern for  
Start Time: 2019-07-26T00:00:02.678+02:100:

I have problem especially with this.

Thanks

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [July 29, 2019, 1:08pm UTC](https://discuss.elastic.co/t/uniform-time-formats/192678/4 "2019-07-29T13:08:02Z")

</div>

i am not really sure what the last part is (the "`:100:`")

The beginning would be: yyyy-MM-ddTHH:mm:ss.SSS  
All after the millisecond is non standard and i think it will have to be transformed with a ruby filter. (The only way i can think of)

---

<div class="post-metadata">

**Author:** ![mvenkat\_in](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\
**Post date:** [July 30, 2019, 3:40am UTC](https://discuss.elastic.co/t/uniform-time-formats/192678/5 "2019-07-30T03:40:33Z")

</div>

Input:  
req\_dtm - **2019-07-26T00:00:16.266+02:00**  
Date Filter to change format  
date {  
match =\> ["req\_dtm", "yyyy-MM-dd'T'HH:mm:ss.SSS"]  
target =\> "request\_dtm"  
}  
Output:  
**\_dateparsefailure**

Input:  
trans\_dtm - **2019-07-26 00:00:16,562**  
Date Filter to change format  
date {  
match =\> ["trans\_dtm", "yyyy-MM-dd HH:mm:ss,SSS"]  
target =\> "response\_dtm"  
}  
Output:  
**2019-07-26T00:00:16.562Z** -- Looks OK.

Kindly suggest how to handle the first one which is resulting in parsing failure.

Thanks

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [July 30, 2019, 4:56am UTC](https://discuss.elastic.co/t/uniform-time-formats/192678/6 "2019-07-30T04:56:33Z")

</div>

now that thems more like a standard dateformat  
try to append a ZZ to the first pattern

```auto
ZZ Timezone offset structured as HH:mm (colon in between hour and minute offsets). Example: -07:00.

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 27, 2019, 4:56am UTC](https://discuss.elastic.co/t/uniform-time-formats/192678/7 "2019-08-27T04:56:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.