# Date filter fails to convert String value

**URL:** https://discuss.elastic.co/t/date-filter-fails-to-convert-string-value/101258
**Category:** Logstash
**Created:** [September 21, 2017, 3:01am UTC](https://discuss.elastic.co/t/date-filter-fails-to-convert-string-value/101258 "2017-09-21T03:01:23Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![glipinski](https://avatars.discourse-cdn.com/v4/letter/g/c5a1d2/32.png) [@glipinski](https://discuss.elastic.co/u/glipinski)
#### Post date: [September 21, 2017, 3:01am UTC](https://discuss.elastic.co/t/date-filter-fails-to-convert-string-value/101258/1 "2017-09-21T03:01:23Z")

</div>

Hi,

My logs are in xml format.  
I am using xml filter to parse them and select specific fields.  
One of the fields is Time

`xpath => [" .//Time/text()", "timestamp"]`

I want to use this filed as a base timestamp (the filed will represent when the event occurred)

thats, why I further use date filter to convert String to Date

```
  date {
      match => ["timestamp", "yyyy-MM-dd HH:mm:ss.SSS"]
    }

```

Unfortunatelly convertion fails, \_dateparsefailure is present in event tags

Full pipeline:

```
input {
      beats {
        port => 5044
      }
    }

    filter{
  xml{
    source => "message"
    target => "doc"
    xpath => [
      ".//Time/text()", "timestamp"
    ]
  }
  date {
      match => ["timestamp", "yyyy-MM-dd HH:mm:ss.SSS"]
    }
}

```

Example of date

> 2017-09-19 22:44:44.238

Could you advice what filters/parameters can I use to fix it?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 24, 2017, 7:32pm UTC](https://discuss.elastic.co/t/date-filter-fails-to-convert-string-value/101258/2 "2017-09-24T19:32:48Z")

</div>

Please show an example event produced by Logstash. Copy/paste from Kibana's JSON tab or use a `stdout { codec => rubydebug }` output. Also, look in the Logstash log. If the date filter fails it'll give you clues about what it chokes on.

---

<div class="post-metadata">

### Author: ![glipinski](https://avatars.discourse-cdn.com/v4/letter/g/c5a1d2/32.png) [@glipinski](https://discuss.elastic.co/u/glipinski)
#### Post date: [September 25, 2017, 8:38am UTC](https://discuss.elastic.co/t/date-filter-fails-to-convert-string-value/101258/3 "2017-09-25T08:38:24Z")

</div>

Hello,

the issue is resolved.  
Value captured by xpath was an array.

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html#plugins-filters-xml-xpath](https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html#plugins-filters-xml-xpath)

```
filter{
  xml{
    source => "message"
    target => "doc"
    xpath => [
      ".//Time/text()", "arrayTimestamp"
    ]
  }
	
  mutate {
    add_field => { "timestamp" => "%{arrayTimestamp[0]}"}
    remove_field => ["arrayTimestamp"]
  }

  date {
    match => ["timestamp", "yyyy-MM-dd HH:mm:ss.SSS"]
    timezone => 'Europe/Berlin'
    target => "timestamp"
  }
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 23, 2017, 8:39am UTC](https://discuss.elastic.co/t/date-filter-fails-to-convert-string-value/101258/4 "2017-10-23T08:39:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
