# Datetime from sql to Timestamp logstash

**URL:** <https://discuss.elastic.co/t/datetime-from-sql-to-timestamp-logstash/117594>\
**Category:** Logstash\
**Created:** [January 30, 2018, 9:58am UTC](https://discuss.elastic.co/t/datetime-from-sql-to-timestamp-logstash/117594 "2018-01-30T09:58:41Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![Anuar\_Mukatov](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Anuar\_Mukatov](https://discuss.elastic.co/u/Anuar_Mukatov)\
**Post date:** [February 1, 2018, 2:56pm UTC](https://discuss.elastic.co/t/datetime-from-sql-to-timestamp-logstash/117594/21 "2018-02-01T14:56:28Z")

</div>

I tried it, but without changes.

---

<div class="post-metadata">

**Author:** ![Anuar\_Mukatov](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Anuar\_Mukatov](https://discuss.elastic.co/u/Anuar_Mukatov)\
**Post date:** [February 2, 2018, 3:07am UTC](https://discuss.elastic.co/t/datetime-from-sql-to-timestamp-logstash/117594/22 "2018-02-02T03:07:47Z")

</div>

my output -

 ![25](https://us1.discourse-cdn.com/elastic/original/3X/7/d/7d2fb11594709263f8f4326d317f75505bc1202d.png) ![26](https://us1.discourse-cdn.com/elastic/original/3X/8/0/80007c12f4d054b107adc4fb57122f588182a67b.png)

---

<div class="post-metadata">

**Author:** ![ericohtake](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericohtake/32/24539_2.png) [@ericohtake](https://discuss.elastic.co/u/ericohtake)\
**Post date:** [February 2, 2018, 3:51am UTC](https://discuss.elastic.co/t/datetime-from-sql-to-timestamp-logstash/117594/23 "2018-02-02T03:51:08Z")

</div>

Anuar, from this point I don’t have any more suggestions for you besides asking you to analyze carefully your debug log and read the docs once again. Also, what always help me is to start a fresh config file, use the stdin input plugin, no filters to start with, output to stdout and paste only the data you are trying to parse onto console. From there, build my filters configuration piece by piece.

It will make it easier to pinpoint the problem. Also reread all this topic, I think you are missing something. Good luck!

---

<div class="post-metadata">

**Author:** ![Anuar\_Mukatov](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Anuar\_Mukatov](https://discuss.elastic.co/u/Anuar_Mukatov)\
**Post date:** [February 2, 2018, 4:23am UTC](https://discuss.elastic.co/t/datetime-from-sql-to-timestamp-logstash/117594/24 "2018-02-02T04:23:49Z")

</div>

Ok, but last question, may be it is beacause of i use jdbc plugin input?

---

<div class="post-metadata">

**Author:** ![Anuar\_Mukatov](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Anuar\_Mukatov](https://discuss.elastic.co/u/Anuar_Mukatov)\
**Post date:** [February 7, 2018, 11:24am UTC](https://discuss.elastic.co/t/datetime-from-sql-to-timestamp-logstash/117594/25 "2018-02-07T11:24:02Z")

</div>

Hello, i found how to do it)  
It turns out logstash does not understand that datetime it is date value.  
Need before convert this field to string -

```
filter {
    mutate {
	add_field => { "message" => "%{typenameru}" }
        convert => ["datetime", "string"]
}
date {
    timezone => "Etc/GMT-6"
    match => ["datetime" , "ISO8601", "yyyy-MM-dd HH:mm:ss.SSS"]
    target => "@timestamp"
    remove_field => ["datetime", "timestamp"]
}
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 7, 2018, 11:24am UTC](https://discuss.elastic.co/t/datetime-from-sql-to-timestamp-logstash/117594/26 "2018-03-07T11:24:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/datetime-from-sql-to-timestamp-logstash/117594.md?page=1)