# Convert field containing a timestamp from string to a date / time or timestamp?

**URL:** <https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594>\
**Category:** Logstash\
**Created:** [February 26, 2021, 10:26am UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594 "2021-02-26T10:26:02Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [February 26, 2021, 10:26am UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/1 "2021-02-26T10:26:02Z")

</div>

Hello

As you can observe here, I have a two fields containing date and time:

![image](https://us1.discourse-cdn.com/elastic/original/3X/2/6/267f452a348be1e86d3ff7e878aa902ef1318c94.png)

Id like to change it so Elastic stores it as a date/time and maybe even change the order (yyyy/mm/dd hh/mm ) How can I change this?

My logstash config:

```
input {
  http {
    port => 5057
  }
}

filter

{

  if [host] != "172.16.2.201"

 {

        drop { }

   }

 }

filter {
csv {
source => "message"
columns => [
"Timestamp",
"EventType",
"TimeOfConnection",
"SessionID",
"SessionName",
"NumberOfHostsConnected",
"LoggedOnDomain",
"LoggedOnUser"
]
}

}

output
{

    elasticsearch {

hosts => ["localhost"]
user => ["elastic"]
password => ["mypass"]

index => "myndex-%{+yyyy.MM.dd}"

        }

```

How can I get it to convert it to a timestamp ?

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [February 26, 2021, 12:09pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/2 "2021-02-26T12:09:17Z")

</div>

You can use the [date filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) to convert your data to your desired output.

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [February 26, 2021, 12:22pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/3 "2021-02-26T12:22:01Z")

</div>

OK but in my example, how would I use it?

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [February 26, 2021, 12:24pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/4 "2021-02-26T12:24:58Z")

</div>

Are you saying this would work:

```
filter {
      date {
        match => ["Timestamp", "dd/MM/yyyy H:mm:ss"]
      }
    }

```

??

Just tried it and it doesnt.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [February 26, 2021, 12:32pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/5 "2021-02-26T12:32:14Z")

</div>

Add a [target property](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-target) if you want to keep the same field name. If not it will save that as `@timestamp`.

```auto
filter {
 date {
  match => ["Timestamp", "dd/MM/yyyy H:mm:ss"]
  target => "Timestamp"
 }
}

```

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 2, 2021, 11:51am UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/6 "2021-03-02T11:51:32Z")

</div>

So for me it would be:

```auto
input {
  http {
    port => 5057
  }
}

filter

{

  if [host] != "172.16.2.201"

 {

        drop { }

   }

 }

filter {
csv {
source => "message"
columns => [
"Timestamp",
"EventType",
"TimeOfConnection",
"SessionID",
"SessionName",
"NumberOfHostsConnected",
"LoggedOnDomain",
"LoggedOnUser"
]
}

}

filter {
 date {
  match => ["TimeOfConnection", "dd/MM/yyyy H:mm:ss"]
  target => "TimeOfConnection"
 }
}

output
{

    elasticsearch {

hosts => ["localhost"]
user => ["elastic"]
password => ["mypass"]

index => "myndex-%{+yyyy.MM.dd}"

        }

```

Would this be correct?

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 2, 2021, 12:08pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/7 "2021-03-02T12:08:22Z")

</div>

That seems to still store it as a string.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [March 2, 2021, 1:31pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/8 "2021-03-02T13:31:46Z")

</div>

What is your mapping?

```auto
      "date": {
        "type": "date"
      }

```

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 2, 2021, 2:27pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/9 "2021-03-02T14:27:39Z")

</div>

I do not understand your question sorry

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [March 2, 2021, 2:41pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/10 "2021-03-02T14:41:02Z")

</div>

Every index has an associated [mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html) where you tell it what the data is going to be in the index and what type it is.

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 2, 2021, 2:54pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/11 "2021-03-02T14:54:49Z")

</div>

I receive the data from logstash and send it to Elasticsearch from Logstash. I do not do anything with the index except name it.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [March 2, 2021, 3:08pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/12 "2021-03-02T15:08:22Z")

</div>

When you first write to an index if a mapping does not exist it will create one for you. Since your data type was a string initially it's most likely mapped as a keyword/text.

If you don't have any important data in that index then the easiest fix is to delete that index and then let it automatically create a new one and should pick that up as a date now.

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 2, 2021, 3:08pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/13 "2021-03-02T15:08:59Z")

</div>

OK, let me give it a shot and delete the Kibana index.

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 2, 2021, 3:11pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/14 "2021-03-02T15:11:00Z")

</div>

I dont think it worked because when it says "Select a primary time field for use with the global time filter." it doesnt allow me to select that field....

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 2, 2021, 3:12pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/15 "2021-03-02T15:12:41Z")

</div>

Although it picks it up as a string, the format is different:

![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a688818c4b01b3551e7372151efad9a5d611e464.png)

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [March 2, 2021, 3:15pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/16 "2021-03-02T15:15:55Z")

</div>

Did you create an [index pattern](https://www.elastic.co/guide/en/kibana/current/index-patterns.html)? You might need to refresh/delete that also before bringing in new data.

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 2, 2021, 3:16pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/17 "2021-03-02T15:16:36Z")

</div>

When you asked me to delete the index, that is what I did: Delete the Kibana index pattern.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [March 2, 2021, 3:18pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/18 "2021-03-02T15:18:45Z")

</div>

Did you delete your index also? If not then you still have data in your old format that elastic will think is a string and assign it text for mapping.

The best way to do this is to delete index and pattern. Then manually set your index mapping. Then ingest the new data.

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 2, 2021, 3:19pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/19 "2021-03-02T15:19:45Z")

</div>

Oh OK, I understand you know, sorry.

Could you clear up what you mean by:

"Then manually set your index mapping."

Thanks

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [March 2, 2021, 3:24pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/20 "2021-03-02T15:24:31Z")

</div>

You can [create a mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html) associated to an index and tell it what fields and data types to expect. Then when data comes in it will map it correctly.

Your date field would look like

```auto
"TimeOfConnection": {
 "type": "date"
}

```

[Next page](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594.md?page=2)