# Date filter plugin error

**URL:** <https://discuss.elastic.co/t/date-filter-plugin-error/238176>\
**Category:** Logstash\
**Created:** [June 23, 2020, 4:07am UTC](https://discuss.elastic.co/t/date-filter-plugin-error/238176 "2020-06-23T04:07:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mhinds](https://avatars.discourse-cdn.com/v4/letter/m/9f8e36/32.png) [@mhinds](https://discuss.elastic.co/u/mhinds)\
**Post date:** [June 23, 2020, 4:07am UTC](https://discuss.elastic.co/t/date-filter-plugin-error/238176/1 "2020-06-23T04:07:06Z")

</div>

The date filter plugin is incorrectly overwriting the month of my date with January, see example output below and configuration.

Logstash Conf File

```ruby
input {
  stdin {}
}

filter {

            date {
                target => "event.start"
                match => [
                    "message",
                    "yyyy-MM-DD HH:mm:ss Z"
                ]
            }

}

output {
  stdout {}
}

```

Output of logstash parser:

```ruby
2020-08-01 12:54:12 +1000
{
        "message" => "2020-08-01 12:54:12 +1000",
     "@timestamp" => 2020-06-23T04:00:34.098Z,
           "host" => "prd03-lss02.prd03.ops.omss",
    "event.start" => 2020-01-01T02:54:12.000Z,
       "@version" => "1"
}

```

Note with an input of 2020-08-01 12:54:12 +1000 I would expect event.start to be 2020-08-01T02:54:12.000Z, however the month is replaced with 01. It doesn't matter what value goes in for month it just gets overwritten by the date filter with 01. This is not expected behaviour - is there a workaround &/or issue created for this?

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [June 23, 2020, 5:34am UTC](https://discuss.elastic.co/t/date-filter-plugin-error/238176/2 "2020-06-23T05:34:38Z")

</div>

You needed the format `dd`, but wrote `DD`. The first would be the day of the month, the second is the day of the year. Therefore that part of your date, which translates to the first of January, overwrote your month.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 21, 2020, 5:34am UTC](https://discuss.elastic.co/t/date-filter-plugin-error/238176/3 "2020-07-21T05:34:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.