# Using Datestamp in log
**URL:** https://discuss.elastic.co/t/using-datestamp-in-log/132683
**Category:** Logstash
**Created:** [May 21, 2018, 5:08pm UTC](https://discuss.elastic.co/t/using-datestamp-in-log/132683 "2018-05-21T17:08:38Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@sm00thindian](https://discuss.elastic.co/u/sm00thindian)
#### Post date: [May 21, 2018, 5:08pm UTC](https://discuss.elastic.co/t/using-datestamp-in-log/132683/1 "2018-05-21T17:08:38Z")
I have logs that are read after the fact and I need to enter them on my timeline as the events occured not as the logs are read by my shippers. Log entries look like this:
`2018-05-18 01:07:03 - Nagios XI [32] system:localhost - cmdsubsys: User [abcdef01] applied a new configuration to Application subsys`
In my logstash conf file I believe I've isolated the datestamp and now just need to convert it to epoch
```
filter {
grok {
match => ["message", "20%{DATESTAMP:LogTime}"]
}
grok {
match => { "message" => "%{GREEDYDATA:event}" }
}
}
```
Ideally I need time as epoch floating integer (yes I know my log doesn't include milliseconds so I know it'll be rounded)
Any help you could provide would be appreciated.
-krw
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 21, 2018, 7:23pm UTC](https://discuss.elastic.co/t/using-datestamp-in-log/132683/2 "2018-05-21T19:23:10Z")
> match =\> ["message", "20%{DATESTAMP:LogTime}"]
DATESTAMP won't work properly. Here's its definition:
>
Your date format doesn't match DATE\_US or DATE\_EU. Use TIMESTAMP\_ISO8601 instead.
> match =\> { "message" =\> "%{GREEDYDATA:event}" }
This isn't useful. It just copies the whole contents of the `message` field into the `event` field.
---
### Author:  [@sm00thindian](https://discuss.elastic.co/u/sm00thindian)
#### Post date: [May 21, 2018, 8:41pm UTC](https://discuss.elastic.co/t/using-datestamp-in-log/132683/3 "2018-05-21T20:41:32Z")
Thanks Magnus, now I've got most of what I need with this configuration.
filter {
grok {
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} ?%{GREEDYDATA:message}" }
overwrite =\> ["message"]
}
date {
locale =\> "en"
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"]
target =\> "@timestamp"
}
}
How do I add a field with the time in epoch format ... same time as timestamp.
-krw
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 21, 2018, 9:18pm UTC](https://discuss.elastic.co/t/using-datestamp-in-log/132683/4 "2018-05-21T21:18:32Z")
You need to use a ruby filter. I think the timestamp object in the `@timestamp` field has a `to_f` method that you can use, so
```
event.set('epoch', event.get('@timestamp').to_f)
```
should work.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 18, 2018, 9:18pm UTC](https://discuss.elastic.co/t/using-datestamp-in-log/132683/5 "2018-06-18T21:18:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.