# Date filter treat the timestamp of the same log differently

**URL:** <https://discuss.elastic.co/t/date-filter-treat-the-timestamp-of-the-same-log-differently/165403>\
**Category:** Logstash\
**Created:** [January 23, 2019, 12:25pm UTC](https://discuss.elastic.co/t/date-filter-treat-the-timestamp-of-the-same-log-differently/165403 "2019-01-23T12:25:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![e997cd7e8d9915436150](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e997cd7e8d9915436150/32/40255_2.png) [@e997cd7e8d9915436150](https://discuss.elastic.co/u/e997cd7e8d9915436150)\
**Post date:** [January 23, 2019, 12:25pm UTC](https://discuss.elastic.co/t/date-filter-treat-the-timestamp-of-the-same-log-differently/165403/1 "2019-01-23T12:25:21Z")

</div>

Hello  
I hava a problem about date filter.  
My conf is below.

```
input {
	file { path => "/var/log/secure" }
}

filter {
	dissect { mapping => { "message" => "%{timestamp->} %{+timestamp} %{+timestamp} %{hostname} %{another}" } }

	date { match => ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] }
}

output {
	elasticsearch { hosts => "localhost:9200" }
}

```

This is a result of my conf. The november log was recorded in 2019. But The december log was recorded in 2018. Am i wrong? ☹

```
{
      "hostname" => "MHKG",
          "host" => "MHKG",
       "another" => "sshd[13361]: Received disconnect from ::ffff:192.168.244.18: 11: Disconnect requested by Windows SSH Client.\r",
       "message" => "Nov 30 23:44:36 Sensor sshd[13361]: Received disconnect from ::ffff:192.168.244.18: 11: Disconnect requested by Windows SSH Client.\r",
          "path" => "/var/log/secure",
    "@timestamp" => 2019-11-30T23:44:36.000Z,
     "timestamp" => "Nov 30 23:44:36",
      "@version" => "1"
}
{
      "hostname" => "MHKG",
          "host" => "MHKG",
       "another" => "sshd[2264]: Accepted password for root from 192.168.56.1 port 8246 ssh2\r",
       "message" => "Dec 1 02:38:21 Sensor sshd[2264]: Accepted password for root from 192.168.56.1 port 8246 ssh2\r",
          "path" => "/var/log/secure",
    "@timestamp" => 2018-12-01T02:38:21.000Z,
     "timestamp" => "Dec 1 02:38:21",
      "@version" => "1"
}
```

---

<div class="post-metadata">

**Author:** ![danhermann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danhermann/32/33024_2.png) [@danhermann](https://discuss.elastic.co/u/danhermann)\
**Post date:** [January 23, 2019, 12:55pm UTC](https://discuss.elastic.co/t/date-filter-treat-the-timestamp-of-the-same-log-differently/165403/2 "2019-01-23T12:55:56Z")

</div>

@e997cd7e8d9915436150, your input `timestamp` field does not explicitly set the year, so the date filter has to guess the year. In your case, it is correctly guessing that the event with the December `timestamp` field occurred last year in 2018. It is incorrectly guessing that the event with the November `timestamp` occurred this year in 2019. There are currently no settings that affect how the date filter guesses the year for timestamps that do not explicitly provide it. The best way to ensure that the year is correct for your events is to explicitly provide the year in the `timestamp` field.

---

<div class="post-metadata">

**Author:** ![e997cd7e8d9915436150](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e997cd7e8d9915436150/32/40255_2.png) [@e997cd7e8d9915436150](https://discuss.elastic.co/u/e997cd7e8d9915436150)\
**Post date:** [January 23, 2019, 1:39pm UTC](https://discuss.elastic.co/t/date-filter-treat-the-timestamp-of-the-same-log-differently/165403/3 "2019-01-23T13:39:04Z")

</div>

Until last year, logs of 12 months were recorded in the same year.  
But now, January to November recorded in 2019. And December recorded in 2018.  
The same is true with past versions.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 20, 2019, 1:39pm UTC](https://discuss.elastic.co/t/date-filter-treat-the-timestamp-of-the-same-log-differently/165403/4 "2019-02-20T13:39:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.