# Converting string(Time) field to date field...!

**URL:** <https://discuss.elastic.co/t/converting-string-time-field-to-date-field/97339>\
**Category:** Logstash\
**Created:** [August 17, 2017, 5:58am UTC](https://discuss.elastic.co/t/converting-string-time-field-to-date-field/97339 "2017-08-17T05:58:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\
**Post date:** [August 17, 2017, 5:58am UTC](https://discuss.elastic.co/t/converting-string-time-field-to-date-field/97339/1 "2017-08-17T05:58:30Z")

</div>

Hi  
I've a Time field in my log file which is a string type, i want that field to be date field.

#my logstash filter config file  
kv{  
value\_split =\> "="  
}  
date {  
match =\> ["Time","yyyy-MM-dd\_HH:mm:ss.SSS"]  
target =\> "time"  
}  
}

#A sample line of data in my log file  
{"Metrics":"type=METER, name=systems.ellora.core.exception.UnhandledRuntimeMapper, count=0, mean\_rate=0.0, m1=0.0, m5=0.0, m15=0.0, rate\_unit=events/second, Time=2017-08-16\_02:54:59.054"}

---

<div class="post-metadata">

**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\
**Post date:** [August 17, 2017, 6:06am UTC](https://discuss.elastic.co/t/converting-string-time-field-to-date-field/97339/2 "2017-08-17T06:06:54Z")

</div>

Any kind of help is appreciated.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 17, 2017, 8:43am UTC](https://discuss.elastic.co/t/converting-string-time-field-to-date-field/97339/3 "2017-08-17T08:43:39Z")

</div>

There was a thread about this _exact_ problem yesterday.

---

<div class="post-metadata">

**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\
**Post date:** [August 17, 2017, 8:51am UTC](https://discuss.elastic.co/t/converting-string-time-field-to-date-field/97339/4 "2017-08-17T08:51:28Z")

</div>

Thanks for your reply @magnusbaeck.  
There's a doubt araised when i tried the example in elastic website.  
When we use date logstash filter what is happening in behind it, whether it parses our input or converting our input to date type?  
It doesnt seems to be converting the input, just parses in my perspective.  
Correct me if im wrong.  
Thanks in advance.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 17, 2017, 9:22am UTC](https://discuss.elastic.co/t/converting-string-time-field-to-date-field/97339/5 "2017-08-17T09:22:58Z")

</div>

Logstash only sends JSON to Elasticsearch. How Elasticsearch interprets the contents of each field is up to how the mapping of each field have been configured. If no mapping exists for a field ES will usually let its automapper add a suitable mapping based on the field contents.

The field contents produced by the date filter will be recognized as a date by ES, but if the field already has been mapped as a string the field will remain a string.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 14, 2017, 9:23am UTC](https://discuss.elastic.co/t/converting-string-time-field-to-date-field/97339/6 "2017-09-14T09:23:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.