# Date filter to yyyy/MM/dd HH:mm:ss format

**URL:** <https://discuss.elastic.co/t/date-filter-to-yyyy-mm-dd-hhss-format/224569>\
**Category:** Logstash\
**Created:** [March 22, 2020, 6:15pm UTC](https://discuss.elastic.co/t/date-filter-to-yyyy-mm-dd-hhss-format/224569 "2020-03-22T18:15:43Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\
**Post date:** [March 22, 2020, 6:15pm UTC](https://discuss.elastic.co/t/date-filter-to-yyyy-mm-dd-hhss-format/224569/1 "2020-03-22T18:15:43Z")

</div>

Hello,

I´m trying to parse a date field called "ReceiveTime" which has the following format:  
ReceiveTime=2020/03/03 16:47:56

i´m using the next filter in Logstash:  
date {  
match =\> ["ReceiveTime", "yyyy/MM/dd HH:mm:ss"]  
timezone =\> "America/Chicago"  
}

The thing is I got a \_dateparsefailure, it´s not working.  
Anybody knows how to parse this kind of date using date filter? I would like to ingest the logs with this timestamp field, called ReceiveTime.  
Thank you ver much in advance.

Regards

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 22, 2020, 6:59pm UTC](https://discuss.elastic.co/t/date-filter-to-yyyy-mm-dd-hhss-format/224569/2 "2020-03-22T18:59:17Z")

</div>

I would expect that date filter to correctly parse that string. If you use

```
output { stdout { codec => rubydebug } }

```

then what do the ReceiveTime and @timestamp fields look like in the output.

---

<div class="post-metadata">

**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\
**Post date:** [March 23, 2020, 10:30am UTC](https://discuss.elastic.co/t/date-filter-to-yyyy-mm-dd-hhss-format/224569/3 "2020-03-23T10:30:10Z")

</div>

@Badger this is part of the ouput using the rubydebug:

```
     "SessionID" => "0009",
                 "Flags" => "0x4000",
              "sequence" => "6632513",
          "totalPackets" => "1",
            "totalBytes" => "66",
"DeviceGroupHierarchyL2" => "0",
          "SerialNumber" => "0001",
             "StartTime" => "2020/03/03",
       "DestinationZone" => "web",
            "@timestamp" => 2020-03-23T10:26:26.656Z,
               "srcPort" => "port",
       "ParentSessionID" => "0",
                 "proto" => "tcp",
      "IngressInterface" => "ethernet1",
           "ActionFlags" => "0x0",
              "@version" => "1",
          "ActionSource" => "from-policy",
               "dstPort" => "443",
      "SessionEndReason" => "policy-deny",
              "RuleName" => "interzone-default",
           "URLCategory" => "any",
            "SyslogInfo" => "deny",
                   "dst" => "ip",
           "ReceiveTime" => "2020/03/03",
                  "tags" => [[0] "_dataparsefailure" ],

```

Any idea? maybe problem is in HH:mm:ss, because that part seems to be empty.  
Btw, as I told before the value of this field is, for example:  
ReceiveTime=2020/03/03 16:47:56

Thank you very much

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 23, 2020, 3:00pm UTC](https://discuss.elastic.co/t/date-filter-to-yyyy-mm-dd-hhss-format/224569/4 "2020-03-23T15:00:20Z")

</div>

> [@david-vazquez](#):
>
> the value of this field is, for example:  
> ReceiveTime=2020/03/03 16:47:56

Well it is not, is it. It is quite clearly

```
"ReceiveTime" => "2020/03/03",

```

with no time part. Maybe you need a second pattern to match events where the time is missing

```
match => ["ReceiveTime", "yyyy/MM/dd HH:mm:ss", "yyyy/MM/dd"]

```

---

<div class="post-metadata">

**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\
**Post date:** [March 23, 2020, 4:16pm UTC](https://discuss.elastic.co/t/date-filter-to-yyyy-mm-dd-hhss-format/224569/5 "2020-03-23T16:16:34Z")

</div>

When I see the source log I can see the ReceiveTime value, and it´s like I said before.  
I think maybe the problem is kv is not filtering properly the value field, so only date part is parsed but not time part.  
Could it be?

This is part of the source log, which includes the ReceiveTime field:  
ReceiveTime=2020/03/03 16:47:56|SerialNumber=099123|cat=THREAT|Subtype=vulnerability|

Regards

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 23, 2020, 6:57pm UTC](https://discuss.elastic.co/t/date-filter-to-yyyy-mm-dd-hhss-format/224569/6 "2020-03-23T18:57:48Z")

</div>

How is your kv filter configured?

---

<div class="post-metadata">

**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\
**Post date:** [March 24, 2020, 4:25pm UTC](https://discuss.elastic.co/t/date-filter-to-yyyy-mm-dd-hhss-format/224569/7 "2020-03-24T16:25:00Z")

</div>

It´s solved. It was kv problem.

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2020, 4:25pm UTC](https://discuss.elastic.co/t/date-filter-to-yyyy-mm-dd-hhss-format/224569/8 "2020-04-21T16:25:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.