# Date format changes automatically after adding 3600 to dateOptionalTime field

**URL:** <https://discuss.elastic.co/t/date-format-changes-automatically-after-adding-3600-to-dateoptionaltime-field/177166>\
**Category:** Logstash\
**Created:** [April 16, 2019, 11:10pm UTC](https://discuss.elastic.co/t/date-format-changes-automatically-after-adding-3600-to-dateoptionaltime-field/177166 "2019-04-16T23:10:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![manishash](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@manishash](https://discuss.elastic.co/u/manishash)\
**Post date:** [April 16, 2019, 11:10pm UTC](https://discuss.elastic.co/t/date-format-changes-automatically-after-adding-3600-to-dateoptionaltime-field/177166/1 "2019-04-16T23:10:08Z")

</div>

I am using 2.3 version.  
I know very old but i do got to fix the data.  
In a timestamp field which is referenced by got timestamp as of UTC  
I have to add 1 hour to the dateOptionalTime field in 1 index.

logstash conf has got this  
code =\> "event['[@fields][DateField]'] = LogStash::Timestamp.new(event['[@fields][DateField]']) + 3600"

it changes date from "2019-04-12T00:00:00-04:00" to "2019-04-12 01:00:00 -0400"

I see that it did add an hour but gives me error while putting into elastic since format has gone bad.

"error"=\>;"MapperParsingException[failed to parse [@fields.DateField]]; nested: MapperParsingException[failed to parse date field [2019-04-12 01:00:00 -0400], tried both date format [dateOptionalTime], and timestamp number with locale ]; nested: IllegalArgumentException[Invalid format: "2019-04-12 01:00:00 -0400" is malformed at " 01:00:00 -0400"]; "}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 16, 2019, 11:18pm UTC](https://discuss.elastic.co/t/date-format-changes-automatically-after-adding-3600-to-dateoptionaltime-field/177166/2 "2019-04-16T23:18:05Z")

</div>

I do not know if it works in 2.3, but in 6.7 I would do

```
 mutate { gsub => ["[@fields][DateField]", "^([^]+) ([^]+) ([^]+)$", "\1T\2\3" ] }

```

That is -- it divides the field into three space separated strings, then recombines them with different separators.

---

<div class="post-metadata">

**Author:** ![manishash](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@manishash](https://discuss.elastic.co/u/manishash)\
**Post date:** [April 17, 2019, 1:57am UTC](https://discuss.elastic.co/t/date-format-changes-automatically-after-adding-3600-to-dateoptionaltime-field/177166/3 "2019-04-17T01:57:48Z")

</div>

> [@Badger](#):
>
> ```auto
> mutate { gsub => ["[@fields][DateField]", "^([^]+) ([^]+) ([^]+)$", "\1T\2\3" ] }
> 
> ```

thanks, but this did not work, the expression itself wasnt able to catch spaces.

---

<div class="post-metadata">

**Author:** ![manishash](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@manishash](https://discuss.elastic.co/u/manishash)\
**Post date:** [April 17, 2019, 2:39am UTC](https://discuss.elastic.co/t/date-format-changes-automatically-after-adding-3600-to-dateoptionaltime-field/177166/4 "2019-04-17T02:39:00Z")

</div>

Could there be any other way to add 1 hour to this timestamp field

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2019, 2:39am UTC](https://discuss.elastic.co/t/date-format-changes-automatically-after-adding-3600-to-dateoptionaltime-field/177166/5 "2019-05-15T02:39:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.