# Date filter not working and I cannot understand why

**URL:** <https://discuss.elastic.co/t/date-filter-not-working-and-i-cannot-understand-why/118416>\
**Category:** Logstash\
**Created:** [February 5, 2018, 9:26am UTC](https://discuss.elastic.co/t/date-filter-not-working-and-i-cannot-understand-why/118416 "2018-02-05T09:26:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nikhil\_Utane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikhil_utane/32/27547_2.png) [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\
**Post date:** [February 5, 2018, 9:26am UTC](https://discuss.elastic.co/t/date-filter-not-working-and-i-cannot-understand-why/118416/1 "2018-02-05T09:26:17Z")

</div>

Hi, the date filter below just refuses to work. Please help me understand what is wrong here.

From logstash output:  
"@timestamp" =\> 2018-01-25T17:18:14.000Z,  
"new\_timestamp" =\> 2018-01-25T17:17:14.000Z,

```
        date {
          match => ["new_timestamp", "yyyy-MM-dd'T'HH:mm:ss.SSSZ", "ISO8601"]
          target => "@timestamp"
        }

```

Tried all following combinations:

1. match =\> ["new\_timestamp", "ISO8601"]
2. match =\> ["new\_timestamp", "yyyy-MM-dd'T'HH:mm:ss.SSSZ"]
3. match =\> ["new\_timestamp", "yyyy-MM-dd'T'HH:mm:ss.SSSZ", "ISO8601"]

What I am trying to do here is take an existing event and duplicate it and set the timestamp for it to 1 minute less than the original one.

Following is the code I wrote for this purpose:  
ruby {  
code =\> "event.set('new\_timestamp', Time.at(event.get('@timestamp').to\_i - 60 ))"  
}  
clone {  
clones =\> ["clonelog"]  
}  
if [type] == 'clonelog' {  
date {  
match =\> ["new\_timestamp", "yyyy-MM-dd'T'HH:mm:ss.SSSZ", "ISO8601"]  
target =\> "@timestamp"  
}  
mutate {...}  
}

-Thanks  
Nikhil

---

<div class="post-metadata">

**Author:** ![Nikhil\_Utane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikhil_utane/32/27547_2.png) [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\
**Post date:** [February 5, 2018, 9:38am UTC](https://discuss.elastic.co/t/date-filter-not-working-and-i-cannot-understand-why/118416/2 "2018-02-05T09:38:21Z")

</div>

Found the problem. new\_timestamp is already in Datetime format and not string. So I can use mutate rename instead of date filter. Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 5, 2018, 9:38am UTC](https://discuss.elastic.co/t/date-filter-not-working-and-i-cannot-understand-why/118416/3 "2018-03-05T09:38:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.