# Compare Dates in Logstash Pipeline
**URL:** https://discuss.elastic.co/t/compare-dates-in-logstash-pipeline/247415
**Category:** Logstash
**Created:** [September 3, 2020, 3:20pm UTC](https://discuss.elastic.co/t/compare-dates-in-logstash-pipeline/247415 "2020-09-03T15:20:50Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@d-ring](https://discuss.elastic.co/u/d-ring)
#### Post date: [September 3, 2020, 3:20pm UTC](https://discuss.elastic.co/t/compare-dates-in-logstash-pipeline/247415/1 "2020-09-03T15:20:50Z")
I have created a data field during the pipeline and I am trying to find a way to compare that field to see if it is 30 days old or newer. I am not sure how to do about it however.
This is the code I have for creating the date field I am trying to query against.
\
```auto
date {
match => ["modified_creation_date", "yyyy-MM-dd"]
remove_field => ["modified_creation_date"]
target => "creation_date"
}
```
I have tried using an if statement and range along with now-30d/d however that does not appear to work. Does anyone have an idea as to what function I could use to compare the date field I have created? Do I need to create another date field with the date 30 days ago to compare against? Using if, range, something else?
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [September 3, 2020, 4:53pm UTC](https://discuss.elastic.co/t/compare-dates-in-logstash-pipeline/247415/2 "2020-09-03T16:53:12Z")
Welcome @d-ring
I know you can compare two dates that are in the same format (eg ISO8601 ) like this:
```auto
if [date1] <= [date2] {
}
```
But as you say, that would require you to create another date field for 30 days ago.. In this post =\> [Adding 1 day to the date](https://discuss.elastic.co/t/adding-1-day-to-the-date/129168/17)
something similar is done with a ruby filter, please check that out and see if you can make it work. 🙂
Grtz
Willem
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 3, 2020, 5:08pm UTC](https://discuss.elastic.co/t/compare-dates-in-logstash-pipeline/247415/3 "2020-09-03T17:08:27Z")
Does [this](https://discuss.elastic.co/t/logstash-filter-basted-on-log-file-age/241350/2) help?
---
### Author:  [@d-ring](https://discuss.elastic.co/u/d-ring)
#### Post date: [September 23, 2020, 9:47pm UTC](https://discuss.elastic.co/t/compare-dates-in-logstash-pipeline/247415/4 "2020-09-23T21:47:51Z")
Thanks. This is what I needed to get moving the right direction
---
### Author:  [@d-ring](https://discuss.elastic.co/u/d-ring)
#### Post date: [September 23, 2020, 9:51pm UTC](https://discuss.elastic.co/t/compare-dates-in-logstash-pipeline/247415/5 "2020-09-23T21:51:17Z")
For those that might need it, I ended up doing it this way.
```auto
date {
match => ["modified_creation_date", "yyyy-MM-dd"]
remove_field => ["modified_creation_date"]
target => "creation_date"
}
}
if [creation_date] == "" {
mutate { remove_field => ["creation_date"] }
}
ruby {
code => "event['temp_date'] = event['@timestamp']"
}
ruby {
code => 'event.set("30d_ago", LogStash::Timestamp.new(Time.at(event.get("@timestamp").to_f-2592000)))'
}
if [30d_ago] < [creation_date] {
mutate {
add_tag => ["young_domain"]
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 21, 2020, 9:51pm UTC](https://discuss.elastic.co/t/compare-dates-in-logstash-pipeline/247415/6 "2020-10-21T21:51:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.