# Date filter can't read from fieldnames which contain dots (created by the JSON filter)
**URL:** https://discuss.elastic.co/t/date-filter-cant-read-from-fieldnames-which-contain-dots-created-by-the-json-filter/228200
**Category:** Logstash
**Created:** [April 15, 2020, 8:07pm UTC](https://discuss.elastic.co/t/date-filter-cant-read-from-fieldnames-which-contain-dots-created-by-the-json-filter/228200 "2020-04-15T20:07:50Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@dreamspy](https://discuss.elastic.co/u/dreamspy)
#### Post date: [April 15, 2020, 8:07pm UTC](https://discuss.elastic.co/t/date-filter-cant-read-from-fieldnames-which-contain-dots-created-by-the-json-filter/228200/1 "2020-04-15T20:07:50Z")
Hi
I'm having some problems reading timestamps from nested JSON fields.
Let's say I have this JSON document:
`{"time" : "2020-04-15T19:17:03.195641"}`
and I read it with logstash using this filter:
```auto
filter {
json {
source => "message"
}
date {
match => ["time", "ISO8601"]
}
}
```
then everyting works fine and the @timestamp is updated correctly.
But now let's say that I have a nested JSON document that looks like this:
```auto
{"subField" : {"time" : "2020-04-15T19:17:03.195641"}}
```
then when I index the document, the JSON input plugin creates a field called `subField.time`, so I would expect this config to work:
```auto
filter {
json {
source => "message"
}
date {
match => ["subField.time", "ISO8601"]
}
}
```
But this time around, the @timestamp is not read, and logstash just uses the current local time. Is there any trick to reading in timestamps from fields with dots in their name?
regards
Frimann
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 15, 2020, 9:19pm UTC](https://discuss.elastic.co/t/date-filter-cant-read-from-fieldnames-which-contain-dots-created-by-the-json-filter/228200/2 "2020-04-15T21:19:55Z")
> [@dreamspy](#):
>
> Is there any trick to reading in timestamps from fields with dots in their name?
In logstash a field name can contain a dot, and if it contained a dot you would refer to it as [subField.time]. However, your field name does not contain a dot, it is an object call subField that contains a time field. In logstash that is [subField][time]
---
### Author:  [@dreamspy](https://discuss.elastic.co/u/dreamspy)
#### Post date: [April 16, 2020, 12:25am UTC](https://discuss.elastic.co/t/date-filter-cant-read-from-fieldnames-which-contain-dots-created-by-the-json-filter/228200/3 "2020-04-16T00:25:46Z")
That did the trick. Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 14, 2020, 12:25am UTC](https://discuss.elastic.co/t/date-filter-cant-read-from-fieldnames-which-contain-dots-created-by-the-json-filter/228200/4 "2020-05-14T00:25:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.