# Date bad format (filtering)

**URL:** https://discuss.elastic.co/t/date-bad-format-filtering/33853
**Category:** Elasticsearch
**Created:** [November 5, 2015, 10:32am UTC](https://discuss.elastic.co/t/date-bad-format-filtering/33853 "2015-11-05T10:32:07Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![bigolou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bigolou/32/5733_2.png) [@bigolou](https://discuss.elastic.co/u/bigolou)
#### Post date: [November 5, 2015, 10:32am UTC](https://discuss.elastic.co/t/date-bad-format-filtering/33853/1 "2015-11-05T10:32:07Z")

</div>

Hi all,

After I ve been searching on the web, cannot find solution to my current issue.  
I am goint to explain the full context: I am completey a newbie with Kibana, Elastic search and Logstash. I am completely discovering it.

- In my test-client A machine, I have logs (csv format) with that header:  
type,timeLogged,timeQueued,orig,rcpt,orcpt,dsnAction,dsnStatus,dsnDiag,dsnMta,bounceCat,srcType,srcMta,dlvType,dlvSourceIp,dlvDestinationIp,dlvEsmtpAvailable,dlvSize,vmta,jobId,envId,queue,vmtaPool,header\_X-EMarSys-Identify,header\_X-EMarSys-Environment,header\_x-mtnltcampaignid,header\_x-mtnltserviceid,header\_x-mtnltm2pid,header\_x-mtnltid,header\_x-quelle-identify,header\_x-mailing-info,header\_mpxcustomerid,header\_x-member-id,header\_x-wld-type-id,header\_message-id,header\_X-MM-Id,header\_x-wld-site-id,header\_x-wld-network-id,header\_From,dsnReportingMta

(Indeed that comes from a Pmta server).

- On my ELK server, I have this current configuration

[root@emaelktestinstallation conf.d]# ls -alh  
total 36K  
drwxrwxr-x. 2 root root 4.0K Nov 5 11:19 .  
drwxr-xr-x. 3 root root 4.0K Sep 21 19:31 ..  
-rw-r--r-- 1 root root 193 Sep 22 21:26 01-lumberjack-input.conf  
-rw-r--r-- 1 root root 854 Nov 5 11:14 02-pmta.conf  
-rw-r--r-- 1 root root 2.0K Nov 5 10:53 02-pmta.conf.bkp  
-rw-r--r-- 1 root root 12K Nov 5 11:19 .02-pmta.conf.swp  
-rw-r--r-- 1 root root 81 Sep 22 18:44 30-lumberjack-output.conf  
[root@emaelktestinstallation conf.d]#

And the configuration file which is important for me : 02-pmta.conf

The import is working fine.  
However, the issue is that I want to use the timeLogged from my CSV as a @timestamp to be able to build up some graphs.  
Indeed, I would like to use mostly these 2 variables timeLogged and timeQueued to proceed to some performance graphs.

My logstash configuration is currently like that:

input {  
lumberjack {  
port =\> 5000  
type =\> "acct"  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
host =\> "10.40.0.48"  
}  
}

filter {

```
date {
            locale => "en"
            match => ["timeQueued", "YYYY-MM-dd;HH:mm:ss.SSS"]
            timezone => "Europe/Vienna"
            target => "@timestamp"
            add_field => { "debug" => "timestampMatched"}
      }

    }

```

output {  
elasticsearch {  
action =\> "index"  
host =\> "localhost"  
index =\> "pmta\_acct"  
workers =\> 1  
}  
stdout {}  
}

I can see all the entries in Kibana, But the timeQueued is still not used as @timestamp.

Any idea, how to proceed ?

As you can see in the picture bellow:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d6dfb28e35e0815f9b0c1f03660e5aa66baab199.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:40pm UTC](https://discuss.elastic.co/t/date-bad-format-filtering/33853/2 "2017-07-05T23:40:22Z")

</div>