# Date config issue and removing GMT

**URL:** <https://discuss.elastic.co/t/date-config-issue-and-removing-gmt/115107>\
**Category:** Logstash\
**Created:** [January 11, 2018, 2:24pm UTC](https://discuss.elastic.co/t/date-config-issue-and-removing-gmt/115107 "2018-01-11T14:24:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![spectre](https://avatars.discourse-cdn.com/v4/letter/s/e99b99/32.png) [@spectre](https://discuss.elastic.co/u/spectre)\
**Post date:** [January 11, 2018, 2:24pm UTC](https://discuss.elastic.co/t/date-config-issue-and-removing-gmt/115107/1 "2018-01-11T14:24:11Z")

</div>

Hello All,

I've been asked to find a log storage solution and i found one i love... 🙂

The install of everything went great with zero errors and my initial imports were working but the Kibana functionality isn't there due to my horrible import method.

[Log Format \<netscaler.csv\>](https://pastebin.com/PaERY5Gz)

[Config File](https://pastebin.com/3UY731P4)

Other Info:  
ELK Stack on Ubuntu server, geo-ip plugin, csv filter

The end goal would be to create a view to see dates and times a user logged in for auditing, but i believe the **GMT-0500** is affecting this and needs to be removed.

tl;dr: I require assistance with parsing a log so i can show value to my colleagues in using ELK Stack as our logging solutions.

Cheers

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 23, 2018, 9:08pm UTC](https://discuss.elastic.co/t/date-config-issue-and-removing-gmt/115107/2 "2018-01-23T21:08:11Z")

</div>

> The end goal would be to create a view to see dates and times a user logged in for auditing, but i believe the GMT-0500 is affecting this and needs to be removed.

What's the current result that you're getting? What do you expect to get instead?

---

<div class="post-metadata">

**Author:** ![spectre](https://avatars.discourse-cdn.com/v4/letter/s/e99b99/32.png) [@spectre](https://discuss.elastic.co/u/spectre)\
**Post date:** [January 24, 2018, 4:27pm UTC](https://discuss.elastic.co/t/date-config-issue-and-removing-gmt/115107/3 "2018-01-24T16:27:59Z")

</div>

Hey Magnus,

The current result is: [DetectionTime:Thu Jan 4 15:55:58 GMT-0500 2018] and the detection time is a string and not a date.

It will not allow me to choose DetectionTime as a date, my belief is this is due to the GMT-0500 in the DTS.

Cheers

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 25, 2018, 10:08am UTC](https://discuss.elastic.co/t/date-config-issue-and-removing-gmt/115107/4 "2018-01-25T10:08:07Z")

</div>

Seems like the date filter isn't working then. If it fails to parse a timestamp string it'll give clues about where the parsing failed in the Logstash log.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2018, 10:08am UTC](https://discuss.elastic.co/t/date-config-issue-and-removing-gmt/115107/5 "2018-02-22T10:08:10Z")

</div>

Closed on February 22, 2018, 10:08am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.