# Match date pattern in Syslog format

**URL:** <https://forum.opensearch.org/t/match-date-pattern-in-syslog-format/24028>\
**Category:** Data Prepper\
**Created:** [April 4, 2025, 2:55pm UTC](https://forum.opensearch.org/t/match-date-pattern-in-syslog-format/24028 "2025-04-04T14:55:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![piotrfrq](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@piotrfrq](https://forum.opensearch.org/u/piotrfrq)\
**Post date:** [April 4, 2025, 2:55pm UTC](https://forum.opensearch.org/t/match-date-pattern-in-syslog-format/24028/1 "2025-04-04T14:55:23Z")

</div>

Data prepper 2.10.2

Creating @timestamp from Syslog time format using this processor:

```auto
 - date:
        match:
          - key: time
            patterns: ["MMM dd HH:mm:ss"]

```

‘time’ field comes from Fluentbit standard syslog parser.

Example time field:  
`"time":"Apr 4 13:17:07"`

When day number is one digit like in the above example Data prepper will not create @timestamp field.

When day number is two digit:  
`"time":"Mar 31 16:59:10"`

date processor matches and @timefield is added to the index.

The reason looks obvious:  
`"time":"Apr 4 13:17:07"`  
`"time":"Mar 31 16:59:10"`

two spaces vs one space between month and day. And this fails the dataprepper match for date pattern.

When I change the processor to this:

```auto
 - date:
        match:
          - key: time
            patterns: ["MMM dd HH:mm:ss"]

```

It works (added extra space). But that is not a solution of course. What am I missing here? Because I simply don’t believe that Dataprepper cannot handle the most popular date format in Linux.

P.

---

<div class="post-metadata">

**Author:** ![piotrfrq](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@piotrfrq](https://forum.opensearch.org/u/piotrfrq)\
**Post date:** [April 7, 2025, 12:22pm UTC](https://forum.opensearch.org/t/match-date-pattern-in-syslog-format/24028/2 "2025-04-07T12:22:03Z")

</div>

Hm, shame, but for those who wonder how to solve it easly. Date processor pattern is a **list** of patterns, so I could use more than one pattern, what I actually did.

```auto
- date:
        match:
          - key: time
            patterns: ["MMM d HH:mm:ss","MMM d HH:mm:ss"]

```

And that is it. Not very elegant, this pattern should rather be regex not such fixed one, but for this scenario is enough.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [June 6, 2025, 12:22pm UTC](https://forum.opensearch.org/t/match-date-pattern-in-syslog-format/24028/3 "2025-06-06T12:22:28Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.