# CSV field from string to Date **URL:** \ **Category:** Logstash\ **Created:** [December 16, 2017, 4:50am UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069 "2017-12-16T04:50:51Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Sridhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sridhar/32/64860_2.png) [@Sridhar](https://discuss.elastic.co/u/Sridhar)\ **Post date:** [December 16, 2017, 4:50am UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/1 "2017-12-16T04:50:51Z")
Hi, I have to convert the Run\_date of the CSV file as date but its populating as string. Please help me..!! Sample CSV file; 30-NOV-17,GH,381,CUSTOMERS 30-NOV-17,GH,50047,TRANSACTIONS 30-NOV-17,IQ,0,TRANSACTIONS 30-NOV-17,KE,631,CUSTOMERS 30-NOV-17,KE,95374,TRANSACTIONS ## Below is the config file - cat logstconf.conf input { file { path =\> "/tmp/filename.csv" type =\> "csv" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { csv { separator =\> "," columns =\> ["Run\_date","Cntry\_code","Count","Cust\_OR\_TRAN"] skip\_empty\_columns =\> true } date { match =\> ["Run\_date", "dd-MMM-yy"] } mutate{ convert =\> { "Count" =\> "integer" } } mutate{ add\_field =\> { "application" =\> "appnme" } } mutate{ add\_field =\> { "Environment" =\> "prd" } } } output { elasticsearch{ action =\> "index" #hosts =\> "[http://localhost:9200](http://localhost:9200)" hosts =\> "[http://localhost:9200](http://localhost:9200)" index =\> "indexname" workers =\> 1 ``` } stdout { codec => rubydebug } ``` } ---
**Author:** ![Kurt\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurt_s/32/17755_2.png) [@Kurt\_S](https://discuss.elastic.co/u/Kurt_S)\ **Post date:** [December 18, 2017, 12:07am UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/2 "2017-12-18T00:07:10Z")
I think you need to add "target =\> "Run\_date" to the date filter. ---
**Author:** ![Sridhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sridhar/32/64860_2.png) [@Sridhar](https://discuss.elastic.co/u/Sridhar)\ **Post date:** [December 18, 2017, 3:56am UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/3 "2017-12-18T03:56:44Z")
Thanks.. will try and let you know.. ---
**Author:** ![Sridhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sridhar/32/64860_2.png) [@Sridhar](https://discuss.elastic.co/u/Sridhar)\ **Post date:** [December 18, 2017, 5:52am UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/4 "2017-12-18T05:52:49Z")
> [@Kurt\_S](#): > > I think you need to add "target =\> "Run\_date" t hi, I have tried the target as below. date { match =\> ["Run\_date", "dd-MMM-yy"] target =\> "Run\_date" } good news is its accept the Run\_date as date. but its capturing the time in 24hrs format. below is the Logstash output. { "path" =\> "filename.csv", "@timestamp" =\> 2017-12-18T05:37:52.874Z, "Cust\_OR\_TRAN" =\> "CUSTOMERS", "@version" =\> "1", "Environment" =\> "PRD", "Run\_date" =\> 2017-12-05T16:00:00.000Z, "Count" =\> 1225, "message" =\> "06-DEC-17,ZM,1225,CUSTOMERS", "type" =\> "csv", "Cntry\_code" =\> "ZM" } I'm expecting the output as like as in the message "06-DEC-17". but actually it takes as " "Run\_date" =\> 2017-12-05T16:00:00.000Z," Please help.!! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 18, 2017, 8:51am UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/5 "2017-12-18T08:51:05Z")
The date filter parses strings into UTC timestamps with millisecond precision. Presumably your timezone is UTC+8, and 2017-12-06T00:00:00,000+0800 =\> 2017-12-05T16:00:00,000+0000 so things look fine. ---
**Author:** ![Sridhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sridhar/32/64860_2.png) [@Sridhar](https://discuss.elastic.co/u/Sridhar)\ **Post date:** [December 18, 2017, 9:49am UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/6 "2017-12-18T09:49:31Z")
Hi, thanks.! can you help me to get only the date in dd-MMM-yy format [as like as in CSV.] the problem why I want to convert is, I'm unable to sort the date as asend / descn while I visualize the same in Kibana. because this capture as a string.. ---
**Author:** ![Kurt\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurt_s/32/17755_2.png) [@Kurt\_S](https://discuss.elastic.co/u/Kurt_S)\ **Post date:** [December 18, 2017, 1:33pm UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/7 "2017-12-18T13:33:25Z")
You can change the way the date is displayed in Kibana in it's settings. In Kibana under "Management" -\> "advanced settings" -\> dateForm ---
**Author:** ![Sridhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sridhar/32/64860_2.png) [@Sridhar](https://discuss.elastic.co/u/Sridhar)\ **Post date:** [December 20, 2017, 2:12pm UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/8 "2017-12-20T14:12:49Z")
Hi.. I have changed the settings in advanced settings and now I can get the date in kibana like DD-MMM-YY. now the problem is as I mentioned earlier the date is converted based on TZ and shows the different date. original --- "message" =\> "06-DEC-17,ZM,1225,CUSTOMERS", conversation --- "Run\_date" =\> 2017-12-05T16:00:00.000Z, Pls help me here..!! ---
**Author:** ![Kurt\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurt_s/32/17755_2.png) [@Kurt\_S](https://discuss.elastic.co/u/Kurt_S)\ **Post date:** [December 20, 2017, 2:25pm UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/9 "2017-12-20T14:25:33Z")
The configuration you posted is not applying a timezone. Are you applying the correct timezone in Logstash in the date filter? ---
**Author:** ![Sridhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sridhar/32/64860_2.png) [@Sridhar](https://discuss.elastic.co/u/Sridhar)\ **Post date:** [December 20, 2017, 5:10pm UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/10 "2017-12-20T17:10:54Z")
No.. I'm not configuring any timezone.. it takes default I believe.... ---
**Author:** ![Kurt\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurt_s/32/17755_2.png) [@Kurt\_S](https://discuss.elastic.co/u/Kurt_S)\ **Post date:** [December 21, 2017, 10:39pm UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/11 "2017-12-21T22:39:22Z")
Date fields are always stored in UTC, so it's only normal they are displayed that way in JSON. When your local time is 06-DEC-17 and logstash adds 00:00 for hours and minutes, the UTC time for that is 2017-12-05T16:00:00.000Z. Kibana is smart enough to translate that back to your local time, and so should any other program. ---
**Author:** ![Sridhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sridhar/32/64860_2.png) [@Sridhar](https://discuss.elastic.co/u/Sridhar)\ **Post date:** [December 22, 2017, 6:13am UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/12 "2017-12-22T06:13:19Z")
Can you help me to configuring kibana to translate back to local time please...!! I just modified the display option in advanced settings like DD-MMM-YY... ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 22, 2017, 6:20am UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/13 "2017-12-22T06:20:53Z")
The display option has nothing to do with this. The timezone adjustment option ("dateFormat:tz") is set to "browser" by default and that's the behavior you're looking for. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 19, 2018, 6:21am UTC](https://discuss.elastic.co/t/csv-field-from-string-to-date/112069/14 "2018-01-19T06:21:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.