# Date filter stuck in 2000

**URL:** https://discuss.elastic.co/t/date-filter-stuck-in-2000/43103
**Category:** Logstash
**Created:** [March 1, 2016, 10:41am UTC](https://discuss.elastic.co/t/date-filter-stuck-in-2000/43103 "2016-03-01T10:41:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![devjr](https://avatars.discourse-cdn.com/v4/letter/d/0ea827/32.png) [@devjr](https://discuss.elastic.co/u/devjr)
#### Post date: [March 1, 2016, 10:41am UTC](https://discuss.elastic.co/t/date-filter-stuck-in-2000/43103/1 "2016-03-01T10:41:53Z")

</div>

Hello,

I have a strange problem with the date filter : whenever I use it and there is no year specified in the field, instead of using the current year, it puts 2000 in @timestamp.  
Tested on a wide variety of logs with different date patterns.  
Tested with logstash 2.1.2 and 2.2.2.

Since I have found no trace of this problem on the web, I think I am doing something wrong.

Could someone please tell me how to do it right ?

TYVM

Example message:  
Mar 1 11:25:01 sv-t-vnl-relaisint01 postfix/qmgr[13312]: DEA6C14E: removed

Filter used :

```
grok {
  match => { "message" => "%{SYSLOGTIMESTAMP:timestamp} %{GREEDYDATA:real_message}"}
}

date {
  match => [ "timestamp",
    "MMM dd HH:mm:ss",
    "MMM d HH:mm:ss"
  ]
  timezone => "Europe/Paris"
  remove_field => ["timestamp"]
}

```

My server date is correct :  
root@sv-t-vnl-logs-central01:~# date  
mardi 1 mars 2016, 11:38:09 (UTC+0100)

---

<div class="post-metadata">

### Author: ![wiibaa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wiibaa/32/44931_2.png) [@wiibaa](https://discuss.elastic.co/u/wiibaa)
#### Post date: [March 1, 2016, 12:19pm UTC](https://discuss.elastic.co/t/date-filter-stuck-in-2000/43103/2 "2016-03-01T12:19:24Z")

</div>

Can you please check the LOCALE of your system, I suspect that you hit a side-effect of [https://github.com/logstash-plugins/logstash-filter-date/issues/57](https://github.com/logstash-plugins/logstash-filter-date/issues/57)

If that the case you must specify `locale => "en"` in your filter config.

---

<div class="post-metadata">

### Author: ![devjr](https://avatars.discourse-cdn.com/v4/letter/d/0ea827/32.png) [@devjr](https://discuss.elastic.co/u/devjr)
#### Post date: [March 1, 2016, 1:26pm UTC](https://discuss.elastic.co/t/date-filter-stuck-in-2000/43103/3 "2016-03-01T13:26:23Z")

</div>

It did the trick, thank you very much !

For the record, version and locale used :

root@sv-t-vnl-logs-central01:/opt/logstash/bin# ./logstash --version  
logstash 2.2.2  
root@sv-t-vnl-logs-central01:/opt/logstash/bin# ./plugin list --verbose logstash-filter-date  
logstash-filter-date (2.1.2)  
root@sv-t-vnl-logs-central01:/opt/logstash/bin# locale  
LANG=fr\_FR.UTF-8  
LANGUAGE=  
LC\_CTYPE="fr\_FR.UTF-8"  
LC\_NUMERIC="fr\_FR.UTF-8"  
LC\_TIME="fr\_FR.UTF-8"  
LC\_COLLATE="fr\_FR.UTF-8"  
LC\_MONETARY="fr\_FR.UTF-8"  
LC\_MESSAGES="fr\_FR.UTF-8"  
LC\_PAPER="fr\_FR.UTF-8"  
LC\_NAME="fr\_FR.UTF-8"  
LC\_ADDRESS="fr\_FR.UTF-8"  
LC\_TELEPHONE="fr\_FR.UTF-8"  
LC\_MEASUREMENT="fr\_FR.UTF-8"  
LC\_IDENTIFICATION="fr\_FR.UTF-8"  
LC\_ALL=

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:09am UTC](https://discuss.elastic.co/t/date-filter-stuck-in-2000/43103/4 "2017-07-06T05:09:07Z")

</div>


