# Dateadd feature in logstash

**URL:** <https://discuss.elastic.co/t/dateadd-feature-in-logstash/105392>\
**Category:** Logstash\
**Created:** [October 26, 2017, 9:49am UTC](https://discuss.elastic.co/t/dateadd-feature-in-logstash/105392 "2017-10-26T09:49:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [October 26, 2017, 9:49am UTC](https://discuss.elastic.co/t/dateadd-feature-in-logstash/105392/1 "2017-10-26T09:49:54Z")

</div>

Hi,

We have some log files which is dynamic in pattern. We would like to filter the logdate field as, whenver the value is null, then that value should be equal to current timestamp less 6hrs.

In sql, its the same as

ISNULL(logdate,dateadd(hour,logdate,6))

I would like to know how can i accomplish this.  
TIA

---

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [November 8, 2017, 9:37am UTC](https://discuss.elastic.co/t/dateadd-feature-in-logstash/105392/2 "2017-11-08T09:37:32Z")

</div>

Nver mind. The workaround we did is to use ruby filter. See below.

```
	ruby {
			init => "require 'time'"
		code => "event.set('logdate', Time.now() - 6*60*60);"
	}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2017, 9:37am UTC](https://discuss.elastic.co/t/dateadd-feature-in-logstash/105392/3 "2017-12-06T09:37:48Z")

</div>

Closed on December 6, 2017, 9:37am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.