# Want to capture timeStamp without milliseconds

**URL:** <https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389>\
**Category:** Logstash\
**Created:** [July 28, 2015, 6:52am UTC](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389 "2015-07-28T06:52:56Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\
**Post date:** [July 28, 2015, 6:52am UTC](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389/1 "2015-07-28T06:52:56Z")

</div>

The CSV contains timeStamp field whose format is "yyyy/MM/dd HH:mm:ss.SSS"  
I want to capture only "yyyy/MM/dd HH:mm:ss"

Used below config but it didn't work.

filter {  
if ([message] =~ "responseCode") {  
drop { }  
} else {  
csv {  
separator =\> ","  
columns =\> ["timeStamp", "elapsed", "label", "responseCode", "responseMessage", "threadName", "dataType", "success", "bytes", "grpThreads", "allThreads", "URL", "Latency", "Encoding", "SampleCount", "ErrorCount", "Hostname", "IdleTime"]  
}  
}  
date { match =\> ["timeStamp", "yyyy/MM/dd HH:mm:ss.SSS", "yyyy/MM/dd HH:mm:ss"]}

}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 28, 2015, 7:45am UTC](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389/2 "2015-07-28T07:45:44Z")

</div>

Use a mutate filter (specifically its gsub parameter) to strip the milliseconds from the timestamp field before you feed it to the date filter.

---

<div class="post-metadata">

**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\
**Post date:** [July 28, 2015, 8:42am UTC](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389/3 "2015-07-28T08:42:57Z")

</div>

> [@magnusbaeck](#):
>
> to strip the milliseconds from the timestamp field

Do you mean below to be done?  
mutate {  
gsub =\> ["timestamp", ".\d{3}", ""]  
}

---

<div class="post-metadata">

**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\
**Post date:** [July 28, 2015, 8:49am UTC](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389/4 "2015-07-28T08:49:23Z")

</div>

I get following error:

←[33mFailed parsing date from field {:field=\>"timeStamp", :value=\>"2015/07/10 05:52:04.586"

I configured as:  
mutate {  
gsub =\> ["timeStamp", ".\d{6}", ""]  
}  
date { match =\> ["timeStamp", "yyyy/MM/dd HH:mm:ss"]}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 28, 2015, 9:01am UTC](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389/5 "2015-07-28T09:01:22Z")

</div>

Periods are metacharacters in regular expressions so you need to escape them, you should anchor the match to the end of the string, and finally you should expect three digits and not six (six digits would be for microseconds). Hence:

```
gsub => ["timeStamp", "\.\d{3}$", ""]
```

---

<div class="post-metadata">

**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\
**Post date:** [July 28, 2015, 1:39pm UTC](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389/6 "2015-07-28T13:39:35Z")

</div>

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:33am UTC](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389/7 "2017-07-06T05:33:36Z")

</div>