# Date filter issue String to ISO Timestamp **URL:** \ **Category:** Logstash\ **Created:** [May 9, 2019, 11:52am UTC](https://discuss.elastic.co/t/date-filter-issue-string-to-iso-timestamp/180354 "2019-05-09T11:52:29Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![bigster](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bigster](https://discuss.elastic.co/u/bigster)\ **Post date:** [May 9, 2019, 11:52am UTC](https://discuss.elastic.co/t/date-filter-issue-string-to-iso-timestamp/180354/1 "2019-05-09T11:52:29Z")
Hi all, I've got another issue with the conversion of dates using the date filter. The main goal i'm trying to achieve is to put the date into the @timestamp field, but it seems that i'm doing something wrong. I've got this date: > "date\_created" =\> "2019-05-09 12:42:52.483023", and i want to put it into the @timestamp field. i've done a lot of thins to try this but nothing worked. Ex: > date { > match =\> ["%{temp\_date\_created}", "YYYY-MM-dd HH:mm:ss.SSS", "ISO8601"] > target =\> "@timestamp" > } > mutate { > add\_field =\> { "temp\_date\_created" =\> "%{date\_created}" } > convert =\> { "temp\_date\_created" =\> "string" } > } > > date { > match =\> ["temp\_date\_created", "", "ISO8601"] > target =\> "@timestamp" > } Any ideas? Cheers, ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 9, 2019, 1:14pm UTC](https://discuss.elastic.co/t/date-filter-issue-string-to-iso-timestamp/180354/2 "2019-05-09T13:14:15Z")
If the field you are parsing has six digits after the . then your pattern has to have SSSSSS. Your pattern has to consume the entire field. Also, you can remove the ``` , "ISO8601" ``` ---
**Author:** ![bigster](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bigster](https://discuss.elastic.co/u/bigster)\ **Post date:** [May 9, 2019, 1:27pm UTC](https://discuss.elastic.co/t/date-filter-issue-string-to-iso-timestamp/180354/3 "2019-05-09T13:27:37Z")
Hi, I've done your recomendation, but the @timestamp remains with its own value: > ``` > "date_created" => "2019-05-09 14:18:52.700813", > > ``` > ``` > "@timestamp" => 2019-05-09T13:21:52.997Z, > > ``` Any reason why the @timestamp remains unchanged. Cheers, ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 9, 2019, 1:32pm UTC](https://discuss.elastic.co/t/date-filter-issue-string-to-iso-timestamp/180354/4 "2019-05-09T13:32:34Z")
``` input { generator { count => 1 lines => [''] } } filter { mutate { add_field => { "date_created" => "2019-05-09 12:42:52.483023" } } date { match => ["date_created", "YYYY-MM-dd HH:mm:ss.SSSSSS"] } } ``` will set @timestamp appropriately. ---
**Author:** ![bigster](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bigster](https://discuss.elastic.co/u/bigster)\ **Post date:** [May 9, 2019, 3:30pm UTC](https://discuss.elastic.co/t/date-filter-issue-string-to-iso-timestamp/180354/5 "2019-05-09T15:30:32Z")
Hi Badger, I'm doing exactly that: ``` mutate { add_field => { "temp_date_created" => "%{date_created}" } convert => { "temp_date_created" => "string" } } date { match => ["%{temp_date_created}", "YYYY-MM-dd HH:mm:ss.SSSSS"] target => "@timestamp" } ``` I've in this approach try to convert into a string, but the @timestamp remains untouchable. ``` "date_created" => "2019-05-09 16:24:04.837336" "@timestamp" => 2019-05-09T15:24:44.054Z, ``` Cheers, ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 9, 2019, 3:31pm UTC](https://discuss.elastic.co/t/date-filter-issue-string-to-iso-timestamp/180354/6 "2019-05-09T15:31:26Z")
No you are not doing exactly that. You have SSSSS, you need to have SSSSSS. The pattern has to match the field it is parsing _exactly_. ---
**Author:** ![bigster](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bigster](https://discuss.elastic.co/u/bigster)\ **Post date:** [May 9, 2019, 4:00pm UTC](https://discuss.elastic.co/t/date-filter-issue-string-to-iso-timestamp/180354/7 "2019-05-09T16:00:47Z")
Your are absolutely correct, i'm sorry for that. But, besides this error, i still have the problem: ``` "temp_date_created" => "2019-05-09 16:36:52.751031", "date_created" => "2019-05-09 16:36:52.751031", "@timestamp" => 2019-05-09T15:37:02.512Z, mutate { add_field => { "temp_date_created" => "%{date_created}" } } date { match => ["%{temp_date_created}", "YYYY-MM-dd HH:mm:ss.SSSSSS"] target => "@timestamp" } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 9, 2019, 4:55pm UTC](https://discuss.elastic.co/t/date-filter-issue-string-to-iso-timestamp/180354/8 "2019-05-09T16:55:22Z")
> [@bigster](#): > > match =\> ["%{temp\_date\_created}", "YYYY-MM-dd HH:mm:ss.SSSSSS"] You do not need a sprintf reference there. Use ``` match => ["temp_date_created", "YYYY-MM-dd HH:mm:ss.SSSSSS"] ``` ---
**Author:** ![bigster](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bigster](https://discuss.elastic.co/u/bigster)\ **Post date:** [May 10, 2019, 2:02pm UTC](https://discuss.elastic.co/t/date-filter-issue-string-to-iso-timestamp/180354/9 "2019-05-10T14:02:53Z")
That's the problem. Thank you very much for the help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 7, 2019, 2:02pm UTC](https://discuss.elastic.co/t/date-filter-issue-string-to-iso-timestamp/180354/10 "2019-06-07T14:02:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.