# Date filter failer

**URL:** <https://discuss.elastic.co/t/date-filter-failer/115334>\
**Category:** Logstash\
**Created:** [January 12, 2018, 4:25pm UTC](https://discuss.elastic.co/t/date-filter-failer/115334 "2018-01-12T16:25:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![avih](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@avih](https://discuss.elastic.co/u/avih)\
**Post date:** [January 12, 2018, 4:25pm UTC](https://discuss.elastic.co/t/date-filter-failer/115334/1 "2018-01-12T16:25:47Z")

</div>

Hi,  
My Date filter fails although the string I'm trying to convert seems to match the matched pattern:

Some of the timestamp string have the following format : 2018-01-12 10:54:20,246  
and some have the following : 2018-01-12 10:54:20.246

if the field was originally formed with comma (by the grok filter) the filter succeed but if the field contains period, it fails.

Below is the code that fails to parse the date getting back : \_dateparsefailure  
...  
mutate {  
gsub =\> ["tmp\_timestamp", ".", ","]  
}

```
    date {
        match => ["tmp_timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
        remove_field => ["tmp_timestamp"]
        target => "log_timestamp"
        timezone => "%{timezone}"
    }

```

...

I tried passing both format : match =\> ["tmp\_timestamp", "yyyy-MM-dd HH:mm:ss,SSS" , "yyyy-MM-dd HH:mm:ss.SSS"]  
with no luck, no matter what I did...

What am I missing ? What can be the filter fail cause that I'm missing ?  
Thanks,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 23, 2018, 9:14pm UTC](https://discuss.elastic.co/t/date-filter-failer/115334/2 "2018-01-23T21:14:09Z")

</div>

The date filter will log a message in the Logstash log when it fails to parse a date.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 20, 2018, 9:14pm UTC](https://discuss.elastic.co/t/date-filter-failer/115334/3 "2018-02-20T21:14:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.