# Date filter does not work

**URL:** https://discuss.elastic.co/t/date-filter-does-not-work/269148
**Category:** Logstash
**Created:** [April 3, 2021, 10:18am UTC](https://discuss.elastic.co/t/date-filter-does-not-work/269148 "2021-04-03T10:18:40Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Andrey\_RF](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrey_rf/32/86484_2.png) [@Andrey\_RF](https://discuss.elastic.co/u/Andrey_RF)
#### Post date: [April 3, 2021, 10:18am UTC](https://discuss.elastic.co/t/date-filter-does-not-work/269148/1 "2021-04-03T10:18:40Z")

</div>

I use `grok` and `date` filter to set correct `@timestamp`. It works in simple case. But when I added if condition `@timestamp` no longer installed from the message.

```auto
filter {
  if 'backend.info.log' in [log][file][path] {
    grok {
      match => [
        "message", '(?m)%{LOGLEVEL:log-level} %{TIMESTAMP_ISO8601:timestamp}.*Пользователь - (?<user>[^;]+).*id - (?<user-id>[^;]+).*email - (?<email>[^;]+).*Агент клиента -(?<useragent>[^;]+).*ip - %{IP:client-ip}.*token: (?<token>[^\n|^\s]+).*Запрос: \"(?<request>[^\s^\"]+).*Метод: \"(?<method>[\w]+).*Параметры: (?<params>\{.*\}).*Модуль: (?<module>[^;]+).*Функция: (?<func>[^;]+), # backend.info.log
      #### Other regexe #####
      ]
    }
  } else {
    grok {
      match => [
        "message", "(?m)%{TIMESTAMP_ISO8601:timestamp} \[%{LOGLEVEL:log-level}\]%{GREEDYDATA:message}", # rabbitmq.info

        "message", "%{LOGLEVEL:log-level} %{TIMESTAMP_ISO8601:timestamp}", # gunicorn.error

            #### Other regexe #####
      ]
    }
  }
  date {
      match => ["message", "yyyy-MM-dd HH:mm:ss,SSS", "yyyy-MM-dd HH:mm:ss", "yyyy-MM-dd HH:mm:ss.SSS", "ISO8601"]
      timezone => "Europe/Moscow"
    }
}

```

I know about multiple regex inside the match, but I have a legacy logs in various formats and and I want to optimize `logstash` work time by using if condition.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 3, 2021, 2:30pm UTC](https://discuss.elastic.co/t/date-filter-does-not-work/269148/2 "2021-04-03T14:30:32Z")

</div>

> [@Andrey\_RF](#):
>
> ```auto
> date {
> match => ["message", "yyyy-MM-dd HH:mm:ss,SSS", "yyyy-MM-dd HH:mm:ss", "yyyy-MM-dd HH:mm:ss.SSS", "ISO8601"]
> timezone => "Europe/Moscow"
> }
> 
> ```

I think where you have `message` it should be `timestamp` since that is the time field you have extracted out of the message

```auto
date {
      match => ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS", "yyyy-MM-dd HH:mm:ss", "yyyy-MM-dd HH:mm:ss.SSS", "ISO8601"]
      timezone => "Europe/Moscow"
    }

```

---

<div class="post-metadata">

### Author: ![Andrey\_RF](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrey_rf/32/86484_2.png) [@Andrey\_RF](https://discuss.elastic.co/u/Andrey_RF)
#### Post date: [April 3, 2021, 6:28pm UTC](https://discuss.elastic.co/t/date-filter-does-not-work/269148/3 "2021-04-03T18:28:47Z")

</div>

Thanks. You are right. Too much time on debugging blunted my attention ☹

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 3, 2021, 6:32pm UTC](https://discuss.elastic.co/t/date-filter-does-not-work/269148/4 "2021-04-03T18:32:34Z")

</div>

🙂 Totally....

We stare at the same screen... same code... Always good to get another set of eyes or take a break... and come back!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 1, 2021, 6:32pm UTC](https://discuss.elastic.co/t/date-filter-does-not-work/269148/5 "2021-05-01T18:32:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.