# Date filter not working with json log

**URL:** <https://discuss.elastic.co/t/date-filter-not-working-with-json-log/159899>\
**Category:** Logstash\
**Created:** [December 7, 2018, 10:09am UTC](https://discuss.elastic.co/t/date-filter-not-working-with-json-log/159899 "2018-12-07T10:09:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![se681268](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@se681268](https://discuss.elastic.co/u/se681268)\
**Post date:** [December 7, 2018, 10:09am UTC](https://discuss.elastic.co/t/date-filter-not-working-with-json-log/159899/1 "2018-12-07T10:09:26Z")

</div>

Hello,  
I'm trying to format date by using filter, and use it as "Time Filter field name" to create index pattern in Kibana.  
I've already have a "date" field in a json-format log, like this:

`{"project":"sth","date":"2018-12-07 17:12:54,332","level":"INFO ","etc.":"etc."}`

And I tried parse "date" in shell:

`echo 'LOG ABOVE' | bin/logstash -e 'input { stdin { codec => json } } filter { date { match => ["log_time", "ISO8601", "YYYY-MM-dd HH:mm:ss,SSS"] target => "logdate" } }'`

The result was:

> [2018-12-07T17:36:23,959][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
> [2018-12-07T17:36:24,567][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.3.2"}  
> [2018-12-07T17:36:27,521][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>8, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50}  
> [2018-12-07T17:36:27,623][INFO][logstash.inputs.stdin] Automatically switching from json to json\_lines codec {:plugin=\>"stdin"}  
> [2018-12-07T17:36:27,673][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x262ccbba run\>"}  
> [2018-12-07T17:36:27,749][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}  
> [2018-12-07T17:36:28,286][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
> {  
> "thread" =\> "some string",  
> "project" =\> "some string",  
> "class" =\> "some string",  
> "date" =\> "2018-12-07 17:12:54,332",  
> "host" =\> "some string",  
> "requestId" =\> "some string",  
> "message" =\> "some string",  
> "level" =\> "INFO ",  
> "@version" =\> "1",  
> "@timestamp" =\> 2018-12-07T09:36:27.786Z  
> }  
> [2018-12-07T17:36:28,532][INFO][logstash.pipeline] Pipeline has terminated {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x262ccbba run\>"}

which is not what I expected.

It should match `"2018-12-07 17:12:54,332"` and convert to date format instead of string, also add a new field named `logdate`.

Is there anything woring?

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [December 7, 2018, 11:02am UTC](https://discuss.elastic.co/t/date-filter-not-working-with-json-log/159899/2 "2018-12-07T11:02:21Z")

</div>

Your telling it to match "log\_time", but you don't have a log\_time field? You have a date field, not a log\_time\_ field?

---

<div class="post-metadata">

**Author:** ![se681268](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@se681268](https://discuss.elastic.co/u/se681268)\
**Post date:** [December 7, 2018, 11:12am UTC](https://discuss.elastic.co/t/date-filter-not-working-with-json-log/159899/3 "2018-12-07T11:12:16Z")

</div>

Thank you so much!

I thought that was just a name that relevant with nothing.  
I'll do more test about that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 4, 2019, 11:23am UTC](https://discuss.elastic.co/t/date-filter-not-working-with-json-log/159899/4 "2019-01-04T11:23:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.