# Write grok for 1 Aug 14 13:30:36 date time

**URL:** https://discuss.elastic.co/t/write-grok-for-1-aug-14-1336-date-time/246231
**Category:** Logstash
**Created:** [August 25, 2020, 7:02am UTC](https://discuss.elastic.co/t/write-grok-for-1-aug-14-1336-date-time/246231 "2020-08-25T07:02:17Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![tharu85](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tharu85](https://discuss.elastic.co/u/tharu85)
#### Post date: [August 25, 2020, 7:02am UTC](https://discuss.elastic.co/t/write-grok-for-1-aug-14-1336-date-time/246231/1 "2020-08-25T07:02:17Z")

</div>

I need to write a proper date time log parser for "1 Aug 14 13:30:36". I found this log from PAM solution and forwarded to the logstash through CEF format.

How ever I have tried several grok patterns to extract, but no luck.

Need help to write proper date time grok or log parser pattern for above mentioned PAM log output of event date & time

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 22, 2020, 7:02am UTC](https://discuss.elastic.co/t/write-grok-for-1-aug-14-1336-date-time/246231/2 "2020-09-22T07:02:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.