# Date filter for logstash seems to change date to older value

**URL:** <https://discuss.elastic.co/t/date-filter-for-logstash-seems-to-change-date-to-older-value/80983>\
**Category:** Logstash\
**Created:** [April 3, 2017, 10:26am UTC](https://discuss.elastic.co/t/date-filter-for-logstash-seems-to-change-date-to-older-value/80983 "2017-04-03T10:26:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![raazeev64](https://avatars.discourse-cdn.com/v4/letter/r/7feea3/32.png) [@raazeev64](https://discuss.elastic.co/u/raazeev64)\
**Post date:** [April 3, 2017, 10:26am UTC](https://discuss.elastic.co/t/date-filter-for-logstash-seems-to-change-date-to-older-value/80983/1 "2017-04-03T10:26:48Z")

</div>

I am parsing logs in the format

`2017-04-03 05:48:16,129....`

I am parsing this using grok as

`match => {"message" => "%{TIMESTAMP_ISO8601:timestamp},.*\|%{DATA:logLevel}\|.*\|.*\|.*\|.*\|.*\|%{DATA:service}\|.*\|.*\|.*\|%{DATA:successMsg} :%{USERNAME:loginUser}"}`

After this I am applying date filter to get timestamp value as -

```
    date {
    							match => ["timestamp", "yyyy-mm-dd HH:mm:ss"]
    							target => "timestamp"
    						}

```

The value I receive in elastic is offset by 3 months.  
ie - **2017-04-03 05:48:16** is coverted to **January 3rd 2017, 05:48:16**

All other fields are fine. Where am I going wrong?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 3, 2017, 11:09am UTC](https://discuss.elastic.co/t/date-filter-for-logstash-seems-to-change-date-to-older-value/80983/2 "2017-04-03T11:09:20Z")

</div>

Use "MM" for the month, not "mm".

---

<div class="post-metadata">

**Author:** ![raazeev64](https://avatars.discourse-cdn.com/v4/letter/r/7feea3/32.png) [@raazeev64](https://discuss.elastic.co/u/raazeev64)\
**Post date:** [April 3, 2017, 1:06pm UTC](https://discuss.elastic.co/t/date-filter-for-logstash-seems-to-change-date-to-older-value/80983/3 "2017-04-03T13:06:18Z")

</div>

Thank you so much!!  
Had been hunting down the logs and config files.

Thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2017, 1:06pm UTC](https://discuss.elastic.co/t/date-filter-for-logstash-seems-to-change-date-to-older-value/80983/4 "2017-05-01T13:06:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.