# Date filter not working \[Solved\]

**URL:** <https://discuss.elastic.co/t/date-filter-not-working-solved/50348>\
**Category:** Logstash\
**Created:** [May 18, 2016, 2:49pm UTC](https://discuss.elastic.co/t/date-filter-not-working-solved/50348 "2016-05-18T14:49:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ruival](https://avatars.discourse-cdn.com/v4/letter/r/7bcc69/32.png) [@ruival](https://discuss.elastic.co/u/ruival)\
**Post date:** [May 18, 2016, 2:49pm UTC](https://discuss.elastic.co/t/date-filter-not-working-solved/50348/1 "2016-05-18T14:49:05Z")

</div>

Hi all,

my first post on logstash forum 🕵️‍♂️

i'm reading events from database using logstash. The events are indexed in elasticsearch.  
There is a event\_timestamp in the table , the column name is "EVENT\_TIMESTAMP" (ORACLE database) and the column type is varchar2(100).

> filter {  
> date {  
> match =\> ["EVENT\_TIMESTAMP" , "yyyy-MM-dd HH:mm:ss.SSS"]  
> target =\> "@timestamp"  
> }  
> }

> output {  
> elasticsearch {  
> hosts =\> ["localhost:9200"]  
> index =\> "logstash-broker"  
> workers =\> 8  
> }
> 
> ```
> stdout {
> codec => rubydebug
> }
> 
> ```
> 
> }

running logstasth the output is the following:

:\Laboratorio\LogStash\logstash-2.3.1\bin\>logstash -f ..\AcoreanaLab\_Broker.con

o/console not supported; tty will not be manipulated  
ettings: Default pipeline workers: 4  
ipeline main started

> ```
> "wmb_msgkey" => "414d51204d5142524b45534230314120074b945320002b03
> 
> ```
> 
> 414d51204d5142524b455342303141206524105725ea753f",  
> "has\_bitstream" =\> "N",  
> "has\_exception" =\> "N",  
> "has\_userdata" =\> "N",  
> "event\_type" =\> "transactionStart",  
> "event\_name" =\> "transactionStart",  
> "event\_srcaddr" =\> nil,  
> "broker\_name" =\> "BRKESB01A",  
> "broker\_uuid" =\> "f0a1f19e-b5c7-4690-aa09-7380652049ab",  
> "exgrp\_name" =\> "eg\_batch\_01",  
> "exgrp\_uuid" =\> "11a47355-4b01-0000-0080-959c9f749b12",  
> "msgflow\_name" =\> "BPM\_TimedSendCheckAbsence",  
> "msgflow\_uuid" =\> "399a3990-4c01-0000-0080-ee0f1a3b7f9d",  
> "appl\_name" =\> nil,  
> "appl\_uuid" =\> nil,  
> "library\_name" =\> nil,  
> "library\_uuid" =\> nil,  
> "node\_name" =\> "Timeout Notification",  
> "node\_type" =\> "ComIbmTimeoutNotificationNode",  
> "detail" =\> nil,  
> "terminal\_name" =\> nil,  
> "key\_fld\_1\_nm" =\> nil,  
> "key\_fld\_2\_nm" =\> nil,  
> "key\_fld\_3\_nm" =\> nil,  
> "key\_fld\_4\_nm" =\> nil,  
> "key\_fld\_5\_nm" =\> nil,  
> "event\_timestamp" =\> "2016-05-18 00:02:34.370",  
> "local\_transaction\_id" =\> "37b2b40a-2615-497c-b41c-11e716ccccf2-3",  
> "parent\_transaction\_id" =\> nil,  
> "global\_transaction\_id" =\> nil,  
> "data\_type" =\> nil,  
> "payload\_size" =\> 0,  
> "@version" =\> "1",  
> "@timestamp" =\> "2016-05-18T14:38:41.356Z",  
> "type" =\> "MonitoringBroker",  
> "tags" =\> [  
> [0] "MonitoringBroker"  
> ]

> ipeline main has been shutdown  
> topping pipeline {:id=\>"main"}  
> he signal HUP is in use by the JVM and will not work correctly on this platform

> :\Laboratorio\LogStash\logstash-2.3.1\bin\>

event\_timestamp = 2016-05-18 00:02:34.370"

but

@timestamp = "2016-05-18T14:38:41.356Z"

why ? what config changes should i make ?

Best regards

Rui Madaleno

---

<div class="post-metadata">

**Author:** ![ruival](https://avatars.discourse-cdn.com/v4/letter/r/7bcc69/32.png) [@ruival](https://discuss.elastic.co/u/ruival)\
**Post date:** [May 18, 2016, 4:41pm UTC](https://discuss.elastic.co/t/date-filter-not-working-solved/50348/2 "2016-05-18T16:41:46Z")

</div>

Found the problem 🙂

changed the value of the field in "match" to lowercase

not-working

filter {  
date {  
match =\> ["EVENT\_TIMESTAMP" , "yyyy-MM-dd HH:mm:ss.SSS"]  
target =\> "@timestamp"  
}  
}  
working

filter {  
date {  
match =\> ["event\_timestamp" , "yyyy-MM-dd HH:mm:ss.SSS"]  
target =\> "@timestamp"  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:57am UTC](https://discuss.elastic.co/t/date-filter-not-working-solved/50348/3 "2017-07-06T04:57:07Z")

</div>