title: logstash parsing timestamp halfday am/pm
body: <p>New to logstash, really enjoying it.  </p>
  
  <p>Trying to parse a CSV file containing a timestamp.  Would like to parse the timestamp and use it as the @timestamp field.</p>
  
  <p>Sample of my CSV input</p>
  
  <pre><code>input {
      stdin {}
  }
  
  filter {
      # filter the input by csv (i.e. comma-separated-value)
      csv {
          columns =&gt; [
              "Job ID",
              "Server Name",
              "Status Code",
              "Job Type",
              "Client Name",
              "Start Time",
              "End Time"
          ]
      }
      # parse the start time to create a real date
      date {
          # Examples of times in this log file
          # "May 29, 2015 10:00:01 PM"
          # "May 9, 2015 4:47:23 AM"
          match =&gt; [ "End Time",
                     "MMM dd, YYYY HH:mm:ss aa",
                     "MMM  d, YYYY HH:mm:ss aa" ]
      }
  }
  
  # send the output to stdout, using the rubydebug codec
  # rubydedug uses the Ruby Awesome Print library
  output {
      stdout { codec =&gt; rubydebug }
  }
  </code></pre>
  
  <p>Sample of my input</p>
  
  <pre><code>108628,anmuswcnbu01,1,Backup,anmuswcrfax01.na.jnj.com,"May 29, 2015 10:00:01 PM","May 30, 2015 6:21:29 AM"
  108629,anmuswcnbu01,1,Backup,anmuswcapps01.na.jnj.com,"May 29, 2015 10:00:01 PM","May 9, 2015 10:51:39 pm"
  108630,anmuswcnbu01,1,Backup,anmuswcapps03.na.jnj.com,"May 29, 2015 10:00:01 PM","May 29, 2015 9:31:19 PM"
  </code></pre>
  
  <p>Sample of my output</p>
  
  <pre><code>Logstash startup completed
  {
          "message" =&gt; [
          [0] "108628,anmuswcnbu01,1,Backup,anmuswcrfax01.na.jnj.com,\"May 29, 2015 10:00:01 PM\",\"May 30, 2015 6:21:29 AM\"\r"
      ],
         "@version" =&gt; "1",
       "@timestamp" =&gt; "2015-05-30T06:21:29.000Z",
             "host" =&gt; "ip-172-31-34-14",
           "Job ID" =&gt; "108628",
      "Server Name" =&gt; "anmuswcnbu01",
      "Status Code" =&gt; "1",
         "Job Type" =&gt; "Backup",
      "Client Name" =&gt; "anmuswcrfax01.na.jnj.com",
       "Start Time" =&gt; "May 29, 2015 10:00:01 PM",
         "End Time" =&gt; "May 30, 2015 6:21:29 AM"
  }
  {
          "message" =&gt; [
          [0] "108629,anmuswcnbu01,1,Backup,anmuswcapps01.na.jnj.com,\"May 29, 2015 10:00:01 PM\",\"May 9, 2015 10:51:39 pm\"\r"
      ],
         "@version" =&gt; "1",
       "@timestamp" =&gt; "2015-05-09T10:51:39.000Z",
             "host" =&gt; "ip-172-31-34-14",
           "Job ID" =&gt; "108629",
      "Server Name" =&gt; "anmuswcnbu01",
      "Status Code" =&gt; "1",
         "Job Type" =&gt; "Backup",
      "Client Name" =&gt; "anmuswcapps01.na.jnj.com",
       "Start Time" =&gt; "May 29, 2015 10:00:01 PM",
         "End Time" =&gt; "May 9, 2015 10:51:39 pm"
  }
  {
          "message" =&gt; [
          [0] "108630,anmuswcnbu01,1,Backup,anmuswcapps03.na.jnj.com,\"May 29, 2015 10:00:01 PM\",\"May 29, 2015 9:31:19 PM\"\r"
      ],
         "@version" =&gt; "1",
       "@timestamp" =&gt; "2015-05-29T09:31:19.000Z",
             "host" =&gt; "ip-172-31-34-14",
           "Job ID" =&gt; "108630",
      "Server Name" =&gt; "anmuswcnbu01",
      "Status Code" =&gt; "1",
         "Job Type" =&gt; "Backup",
      "Client Name" =&gt; "anmuswcapps03.na.jnj.com",
       "Start Time" =&gt; "May 29, 2015 10:00:01 PM",
         "End Time" =&gt; "May 29, 2015 9:31:19 PM"
  }
  Logstash shutdown completed
  </code></pre>
  
  <p>For example, in that last (3rd) row of data, rather than:</p>
  
  <pre><code>"@timestamp" =&gt; "2015-05-29T09:31:19.000Z",
  </code></pre>
  
  <p>I feel like I should be getting</p>
  
  <pre><code>"@timestamp" =&gt; "2015-05-29T21:31:19.000Z",
  </code></pre>
  
  <p>As best I can tell, the date filter seems to be ignoring my "half-day" syntax</p>
  
  <pre><code> match =&gt; [ "End Time",
                     "MMM dd, YYYY HH:mm:ss aa",
                     "MMM  d, YYYY HH:mm:ss aa" ]
  </code></pre>
  
  <p>New to logstash, so wondering if I'm doing something wrong ?</p>
  
  <p>-Chad</p>