# Changing date format through Logstash

**URL:** <https://discuss.elastic.co/t/changing-date-format-through-logstash/325061>\
**Category:** Logstash\
**Created:** [February 8, 2023, 7:51pm UTC](https://discuss.elastic.co/t/changing-date-format-through-logstash/325061 "2023-02-08T19:51:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [February 8, 2023, 7:51pm UTC](https://discuss.elastic.co/t/changing-date-format-through-logstash/325061/1 "2023-02-08T19:51:30Z")

</div>

Hello. We are getting feed from Kafka topic. One of the fields `rdt` appears in the following format:

![image](https://us1.discourse-cdn.com/elastic/original/3X/e/8/e8d28f12920f646e3db35377ed93c63321ecbd7b.png)

I need to change the date format to `YYYY-MM-dd`

This was added in the logstash conf file:

```auto
    if "KafkCollect" in [tags] {

        file {
                   path => "/opt/total/logs/kafkaCollect_rubydebug.txt"
                   codec => rubydebug
                }

        filter {
                mutate {
                     strip => ["rdt"]
                     }
                date {
                      match => ["rdt", "YYYY-MM-dd"]
                      target => "rdt"
                     }
               }

    elasticsearch {
     hosts => ["xxx.xx.xx.xx:43045"]
     hosts => ["xxx.xx.xx.xx:43045"]
     hosts => ["xxx.xx.xx.xx:43045"]
     hosts => ["xxx.xx.xx.xx:43045"]
     user => "datater"
     password => "xxxxxxxxxx"
     index => "dateter-coll-%{+YYYY.MM.dd}"
     manage_template => true
     template_overwrite => true
     template => "/opt/total/logstash/config/data_kafkaCollect_template.json"
     template_name => "dataCollect_template"
                }
        }

```

This gives syntax error at startup.

Please guide

Thanks

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 8, 2023, 8:31pm UTC](https://discuss.elastic.co/t/changing-date-format-through-logstash/325061/2 "2023-02-08T20:31:42Z")

</div>

You want to change how the date appears on Kibana?

If so, this is not related to Logstash, this is how Kibana shows date fields, you can change it, but it will change how kibana show **all** date fields.

To change it you need to go in _Stack Management \> Kibana \> Advanced Settings_

There you will have this setting:

 ![Screenshot from 2023-02-08 17-26-02](https://us1.discourse-cdn.com/elastic/original/3X/5/9/5937a531326f44c74828e88574e51c3309371591.png)

But changing this will change how all date fields are show in Kibana, including the `@timestamp` field.

Another option would be to store the `rdt` field as a string, but you will probably need to change the mapping on your template and reindex your data.

---

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [February 8, 2023, 8:41pm UTC](https://discuss.elastic.co/t/changing-date-format-through-logstash/325061/3 "2023-02-08T20:41:25Z")

</div>

> [@leandrojmp](#):
>
> Another option would be to store the `rdt` field as a string, but you will probably need to change the mapping on your template and reindex your data.

Thanks. This is new set up so I can afford re-indexing.

How do I change the field to string?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 8, 2023, 8:44pm UTC](https://discuss.elastic.co/t/changing-date-format-through-logstash/325061/4 "2023-02-08T20:44:39Z")

</div>

> [@zaeemmasood](#):
>
> How do I change the field to string?

You seem to have a template for your index.

> template =\> "/opt/total/logstash/config/data\_kafkaCollect\_template.json"

So you would need to change the type of the mapping for the field `rdt` to `keyword`.

Just remember that doing this you will not be able to use the field `rdt` as a date field, it will be just a keyword field with the repsentation of the date.

---

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [February 9, 2023, 9:39pm UTC](https://discuss.elastic.co/t/changing-date-format-through-logstash/325061/5 "2023-02-09T21:39:16Z")

</div>

thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2023, 9:40pm UTC](https://discuss.elastic.co/t/changing-date-format-through-logstash/325061/6 "2023-03-09T21:40:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.