# Convert fields from text into date format using in Logstash config file

**URL:** <https://discuss.elastic.co/t/convert-fields-from-text-into-date-format-using-in-logstash-config-file/362621>\
**Category:** Logstash\
**Created:** [July 5, 2024, 3:35pm UTC](https://discuss.elastic.co/t/convert-fields-from-text-into-date-format-using-in-logstash-config-file/362621 "2024-07-05T15:35:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Manoilayans](https://avatars.discourse-cdn.com/v4/letter/m/50afbb/32.png) [@Manoilayans](https://discuss.elastic.co/u/Manoilayans)\
**Post date:** [July 5, 2024, 3:35pm UTC](https://discuss.elastic.co/t/convert-fields-from-text-into-date-format-using-in-logstash-config-file/362621/1 "2024-07-05T15:35:48Z")

</div>

**Logstash conf file:**

filter {  
json {  
source =\> "message"  
}

}

output {  
elasticsearch {  
hosts =\>"[http://xx.xx.xx.xx.com](http://xx.xx.xx.xx.com)"  
index =\> "sample\_data\_%{+YYYY.MM.dd}"  
user =\> "elastic"  
password =\> "xxxxxxxxx"  
}

}

**Index Mappings:**

{  
"mappings": {  
"\_doc": {  
"properties": {  
"@timestamp": {  
"type": "date"  
},  
"@version": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"order": {  
"properties": {  
"createdOn": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"items": {  
"properties": {  
"itemId": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
}  
}  
},  
"orderID": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"totalPrice": {  
"type": "long"  
},  
"updatedOn": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
}  
}  
}  
}  
}  
}  
}

**Sample message stored in Elasticsearch:**

{  
"\_index": "sample\_data\_2024.07.05",  
"\_type": "\_doc",  
"\_id": "pcABgpAB1lurpuJXc5JB",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"order": {  
"createdOn": "2024-05-27 13:23:29",  
"totalPrice": 120,  
"items": {  
"itemId": "AG000284"  
},  
"updatedOn": "2024-05-27 13:23:29",  
"orderID": "DE--499"  
},  
"@timestamp": "2024-07-05T08:27:31.407Z",  
"@version": "1",  
},  
"fields": {  
"@timestamp": [  
"2024-07-05T08:27:31.407Z"  
]  
},  
"sort": [  
1720168051407  
]  
}

\*We need HELP to store the fields as date format using logstash before store the data into Index like below but createdOn & updatedOn fields stored as text format \*

"createdOn": {  
"type": "date"  
}

"updatedOn": {  
"type": "date"  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 5, 2024, 6:28pm UTC](https://discuss.elastic.co/t/convert-fields-from-text-into-date-format-using-in-logstash-config-file/362621/2 "2024-07-05T18:28:23Z")

</div>

You could try

```
    date { match => ["[order][createdOn]", "YYYY-MM-dd HH:mm:ss" ] target => "[order][createdOn]" }
    date { match => ["[order][updatedOn]", "YYYY-MM-dd HH:mm:ss" ] target => "[order][updatedOn]" }

```

which (for me, in GMT-0400) results in

```
         "order" => {
    "totalPrice" => 120,
     "createdOn" => 2024-05-27T17:23:29.000Z,
                ....
     "updatedOn" => 2024-05-27T17:23:29.000Z
},

```

Set the [timezone option](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-timezone) on the date filters if you need to.

---

<div class="post-metadata">

**Author:** ![Manoilayans](https://avatars.discourse-cdn.com/v4/letter/m/50afbb/32.png) [@Manoilayans](https://discuss.elastic.co/u/Manoilayans)\
**Post date:** [July 8, 2024, 10:09am UTC](https://discuss.elastic.co/t/convert-fields-from-text-into-date-format-using-in-logstash-config-file/362621/3 "2024-07-08T10:09:07Z")

</div>

Thanks ! we added

date { match =\> ["[order][createdOn]", "YYYY-MM-dd HH:mm:ss" ] target =\> "[order][createdOn]" }  
date { match =\> ["[order][updatedOn]", "YYYY-MM-dd HH:mm:ss" ] target =\> "[order][updatedOn]" }

and then ingested the data to Logstash via Source system. Document stored and the fields createdOn & updatedOn stored as 'date' data type in the Index Mappings

"createdOn": {  
"type": "date"  
},  
"updatedOn": {  
"type": "date"  
}

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/9/3908e85e59eff2ea49fa2d42f36b3fa9db402217.png)