# Date filter with timestamp

**URL:** <https://discuss.elastic.co/t/date-filter-with-timestamp/41795>\
**Category:** Logstash\
**Created:** [February 15, 2016, 2:24pm UTC](https://discuss.elastic.co/t/date-filter-with-timestamp/41795 "2016-02-15T14:24:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![techrawther](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@techrawther](https://discuss.elastic.co/u/techrawther)\
**Post date:** [February 15, 2016, 2:24pm UTC](https://discuss.elastic.co/t/date-filter-with-timestamp/41795/1 "2016-02-15T14:24:55Z")

</div>

Hi,

I am having syslogs both in PST and CET timezones. One such example is below. I reads the log using file plugin and add the timestamp to a field named logtimestamp. Everything works fine except when I do date parse. I am not sure how should I write my matcher here so that timestamp will be updated accordingly. I tried following

"yyyy/mm/dd@HH:mm:ss-Z", "yyyy/mm/dd@HH:mm:ss-z", "yyyy/mm/dd@HH:mm:ss-TZ" but nothing seem to working

Following is log snippet with both PST and CET and I splits DETAIL, TIME, THREAD and Message from below and time-stamp is written to field "logtimestamp"

```
PST 
[level=DETAIL, time=2016/01/30@13:19:10-PST, thread=ClientClean, msg=<<<EC: eval results: rv=0,stdout="",stderr="">>>]

CET
[level=DETAIL, time=2016/02/15@14:59:53-CET, thread=ClientClean, msg=<<<EC: eval results: rv=0,stdout="",stderr="">>>]

```

I get following error .

```
←[33mFailed parsing date from field {:field=>"logtimestamp", :value=>"2016/01/26@00:52:47-PST", :exception=>"Invalid format: \"2016/01/26@00:52:47-PST\" is malformed at \"-PST\"", :config_parsers=>"yyyy/mm/dd@HH:mm:ss-Z",

```

Following is my date parser

```
date{
	match => ["logtimestamp" , "yyyy/mm/dd@HH:mm:ss-Z"]
	target => "@timestamp"
	add_field => { "debug" => "timestampMatched"}
	}
```

---

<div class="post-metadata">

**Author:** ![techrawther](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@techrawther](https://discuss.elastic.co/u/techrawther)\
**Post date:** [February 15, 2016, 2:37pm UTC](https://discuss.elastic.co/t/date-filter-with-timestamp/41795/2 "2016-02-15T14:37:59Z")

</div>

HI,  
Please ignore this post. I was able to make it working using match =\> ["logtimestamp" , "yyyy/mm/dd@HH:mm:ss-z"]  
Looks like I might have forget to save the config while running earlier.

Thanks alot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:11am UTC](https://discuss.elastic.co/t/date-filter-with-timestamp/41795/3 "2017-07-06T05:11:26Z")

</div>