# Date type in logstash

**URL:** <https://discuss.elastic.co/t/date-type-in-logstash/141929>\
**Category:** Logstash\
**Created:** [July 27, 2018, 11:27am UTC](https://discuss.elastic.co/t/date-type-in-logstash/141929 "2018-07-27T11:27:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![waitangi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waitangi/32/110887_2.png) [@waitangi](https://discuss.elastic.co/u/waitangi)\
**Post date:** [July 27, 2018, 11:27am UTC](https://discuss.elastic.co/t/date-type-in-logstash/141929/1 "2018-07-27T11:27:21Z")

</div>

I really don't know it's the best place to ask my question.  
I use logstash to save logs data in elasticsearch. Grok:

match =\> ["message", "%{TIMESTAMP\_ISO8601:request\_timestamp} %{IP:server\_ip} %{WORD:request\_method} %{URIPATH:request\_uri} %{NOTSPACE:request\_query} %{NUMBER:port} %{NOTSPACE:username} %{IP:client\_ip} %{NOTSPACE:request\_agent} %{NOTSPACE:request\_referer} %{INT:response\_status} %{INT:response\_substatus} %{INT:response\_winstatus} %{INT:response\_timetaken}"]

Data are stored, but when I ask DSL query using DateRange I receive data from outside the range (the query is "show me the logs where logdate is in range"). When I change the column of the range to @timestamp it works - so I suppose logstash saves my date in uncorrect format.  
I changed my index template where the column is defined like this:  
"request\_timestamp" : {  
"type" : "date",  
"format" : "yyyy-MM-dd HH:mm:ss"  
},

---

<div class="post-metadata">

**Author:** ![Charaf\_Ahmed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charaf_ahmed/32/30467_2.png) [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)\
**Post date:** [July 27, 2018, 2:35pm UTC](https://discuss.elastic.co/t/date-type-in-logstash/141929/2 "2018-07-27T14:35:44Z")

</div>

> [@waitangi](#):
>
> I changed my index template where the column is defined like this:  
> "request\_timestamp" : {  
> "type" : "date",  
> "format" : "yyyy-MM-dd HH:mm:ss"  
> },

you have to specify the timezone

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2018, 2:35pm UTC](https://discuss.elastic.co/t/date-type-in-logstash/141929/3 "2018-08-24T14:35:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.