# Convert String to date format **URL:** \ **Category:** Logstash\ **Created:** [December 16, 2020, 5:46pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899 "2020-12-16T17:46:58Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [December 16, 2020, 5:46pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/1 "2020-12-16T17:46:58Z")
Hi All, I am using ELK7.6.2 Trying to convert "createdTime" field from String to date format. Added following filter in my logstash config file: ```auto date { match => ["createdTime", "YYYY-MM-dd HH:mm:ss.SSS"] target => "createdTime" } ``` In the log 'createdTime' shows as follows: ```auto createdTime 2020-12-16 12:35:37,677 ``` Index mapping still shows as 'text' as opposed to 'date' after the change as follows: ```auto "createdTime" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 ``` Please guide. Thanks ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [December 16, 2020, 6:05pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/2 "2020-12-16T18:05:09Z")
What is the output of your filter? Can you `stdout { }` in the output and see what the result of the filter was? ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [December 16, 2020, 6:42pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/3 "2020-12-16T18:42:02Z")
Thanks. The output is as follows. A snippet showing createdTime field is shown below: ```auto "clientIP" => " 1.2.3.4 ", "httpClientThreadName" => " ", "concurrentUserRequests" => 41, "requestPageId" => " abcd ", "mPulseSessionId" => " ", "createdTime" => "2020-12-16 13:37:41,692 ", ``` ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [December 16, 2020, 6:54pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/4 "2020-12-16T18:54:37Z")
Adding an empty space after each entry shouldn't be happening. My first guess is that due to this space it's not a valid date anymore and the mapping thinks it's a string. Just curious if `clientIP` is mapped as an `IP` and working also. ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [December 16, 2020, 6:58pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/5 "2020-12-16T18:58:36Z")
clientIP appears normal and correct IP is displayed. Mapping as follows: ```auto "clientIP" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, ``` Also where should the space be introduced. This is how the config for 'createdTime' field looks. ```auto if [type] == "uat_log_access" { mutate { split => ["message", "~|~"] add_field =>{ "createdTime" => "%{[message][0]}" ``` ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [December 16, 2020, 7:27pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/6 "2020-12-16T19:27:25Z")
I don't see it there. But it would be something common to all fields since they all show an extra space. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 16, 2020, 7:49pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/7 "2020-12-16T19:49:28Z")
> [@zaeemmasood](#): > > `match => ["createdTime", "YYYY-MM-dd HH:mm:ss.SSS"]` In addition to the issue with spaces, your createdTime field has a comma after the seconds, not a period. ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [December 16, 2020, 8:12pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/8 "2020-12-16T20:12:15Z")
Thanks, I fixed the comma part and now stdout looks as follows. Note the createdTime field ( and also the un-wanted extra space) : ```auto "toGPFirstByte" => 25003, "referrer" => " https://abc/review.html ", "gPPerformance" => " 2 ", "totalTimeProxy" => 0, "httpClientThreadName" => " ", "type" => "uat_log_access", "requestPageId" => " ABCD ", "gPName" => " LAMB ", "method" => " POST ", "WebServer" => " web1 ", "toGPLastByte" => 25004, "createdTime" => "2020-12-16 14:57:53,515 ", ``` Wonder where the extra space is configured.. ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [December 16, 2020, 8:17pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/9 "2020-12-16T20:17:30Z")
Well it's a leading and trailing space. `createdTime` doesn't have a leading so I am guessing the `Date` filter fixed it. Also `type` doesn't have one which is set separetly than the message. Just look in your main `dissect`, `grok`, or however you are parsing the main message that comes in. ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [December 16, 2020, 8:46pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/10 "2020-12-16T20:46:51Z")
Thanks. grok looks as follows: ```auto grok{ patterns_dir => ["/opt/app/logstash/patterns"] match => ["IPRequestId","%{GREEDYDATA}%{REQUEST_ID:requestId}"] } ``` It is pointing to a patterns directory which contains a file named 'postfix'. postfix file contains the following: ```auto ACCESS_LOG_SPERATOR (\~\|\~) REQUEST_ID [0-9]{1}\-[0-9]{2}\-.*\-.*\-[0-9,#]+ POSTFIX_QUEUEID [0-9A-F]{10,11} time [0-9]{4}\-[0-9]{2}\-[0-9]{2}\s[0-9]{2}:[0-9]{2}:[0-9]{2}\S[0-9]{3} FTBC \-[FTBC]{2}\- ``` ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [December 17, 2020, 5:09pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/11 "2020-12-17T17:09:04Z")
Is there a way I could add an expression to trim the extra spaces? ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [December 17, 2020, 5:21pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/12 "2020-12-17T17:21:03Z")
You can [strip the fields](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-strip) if you can't find the source of the issue. ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [December 17, 2020, 7:27pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/13 "2020-12-17T19:27:24Z")
Thank you! When I stripped the "createdTime" field the time now displays as follows: ```auto "createdTime": "2020-12-17T19:17:24.453Z", ``` But on running GET for index mapping I still see it "text" as follows: ```auto "createdTime" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, ``` Also when I examine the index pattern, it still shows as "string" : ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/4/24703070c1fb0fc2ae9613e9e28e40abde047c85.png) which is unlike another field named "timestamp" which shows as "date". See below: ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/2/1242d3fdd91157d214b6f56b0ec23b755d1c91e7.png) ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [December 17, 2020, 7:30pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/14 "2020-12-17T19:30:43Z")
Did you delete the index pattern before running again? What does your finished Date Filter look like in Logstash? ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [December 17, 2020, 8:13pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/15 "2020-12-17T20:13:32Z")
So I followed the following sequence: 1. Shutdown Logstash 2. Deleted related index pattern in Kibana 3. Bring up Logstash 4. Searched for same index pattern again and created it. Observed no change in mapping. I don't have any finished date filter defined in logstash config ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [December 17, 2020, 8:15pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/16 "2020-12-17T20:15:36Z")
Your first post has this. Does that still exist? ```auto date { match => ["createdTime", "YYYY-MM-dd HH:mm:ss.SSS"] target => "createdTime" } ``` ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [December 17, 2020, 8:16pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/17 "2020-12-17T20:16:47Z")
yes it does: ```auto mutate { strip => ["createdTime"] } date { match => ["createdTime", "YYYY-MM-dd HH:mm:ss,SSS"] target => "createdTime" } ``` ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [December 17, 2020, 8:19pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/18 "2020-12-17T20:19:46Z")
For testing. Change `target => "createdTime"` to `target => "tempDate"` and check the mapping and what does the data look like? ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [December 17, 2020, 8:37pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/19 "2020-12-17T20:37:23Z")
Changed it to tempDate. Now looks like: ```auto mutate { strip => ["createdTime"] } date { match => ["createdTime", "YYYY-MM-dd HH:mm:ss,SSS"] target => "tempDate" } ``` On checking after deleting the index pattern, tempDate appears as "date" format. See below: ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/c/4c800db6ea06b4fc22cc7266d7c70d6796e2c2b1.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb8a5edc8d4b69c704c80a1721636e4c12edbf54.png) ```auto "tempDate" : { "type" : "date" }, ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 17, 2020, 9:04pm UTC](https://discuss.elastic.co/t/convert-string-to-date-format/258899/20 "2020-12-17T21:04:32Z")
> [@zaeemmasood](#): > > - Shutdown Logstash > - Deleted related index pattern in Kibana Deleting the index pattern does nothing, since the pattern just reflects whatever mapping exists in elasticsearch. When you recreate the pattern it will reflect the text mapping of the field you want to be a date. You need to delete the index in elasticsearch, or start with a new index. [Next page](https://discuss.elastic.co/t/convert-string-to-date-format/258899.md?page=2)