# Does the data input filter work on nested fields?

**URL:** <https://discuss.elastic.co/t/does-the-data-input-filter-work-on-nested-fields/55765>\
**Category:** Logstash\
**Created:** [July 18, 2016, 1:33pm UTC](https://discuss.elastic.co/t/does-the-data-input-filter-work-on-nested-fields/55765 "2016-07-18T13:33:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mormor1971](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@mormor1971](https://discuss.elastic.co/u/mormor1971)\
**Post date:** [July 18, 2016, 1:33pm UTC](https://discuss.elastic.co/t/does-the-data-input-filter-work-on-nested-fields/55765/1 "2016-07-18T13:33:09Z")

</div>

Hello All,

I'm trying to get logstash to parse the date from a nested field in a JSON blob and are having some issues doing so.

Here is what the JSON blob looks like:

{  
"count"27,  
"data":[{  
"hotspotIdentifier":"00193BECD438",  
"dateStart":"2015-06-03 19:11:15",  
"dateStop":"2015-06-03 19:11:55",  
"sessionTime":"39",  
"traffic":362264,  
"terminateCause":"User-Request",  
"username":"4C0EDC30",  
"macAddressUser":"24fd5214637c",  
"ipAddressUser":"192.168.8.1",  
"venueId":"ff8080814d91f65e014dba30cc091d83",  
"online":false  
}]  
}

There are more data nested fields but one will do for this issue.

In my logstash config I have this:

filter {  
split {  
field =\> "data"  
}  
date {  
match =\> ["[startDate]", "yyyy-MM-dd HH:mm:ss" ]  
add\_tag =\> ["startDate\_Matched"]  
}  
date {  
match =\> ["[data][stopDate]", "yyyy-MM-dd HH:mm:ss" ]  
add\_tag =\> ["stopDate\_Matched"]  
}  
}

Which does split out the fields into data.x when looked at from Kibana but no matter what I try I cannot get the date match to work and I never get to see the startDate\_matched/stopDate\_Matched tags either. There's no errors and no grokparsefailures or dateparsefailures either.

If I remove the kv section I just get one long line in \_source and lots of parse failures.

This is what the document (well a similar one but they all looks the same) looks like in Kibana:

{  
"\_index": "cloud4wi-2016.07.18",  
"\_type": "clod4wi\_connections",  
"\_id": "AVX-LS-VyWbKOs9i0BQf",  
"\_score": 1,  
"\_source": {  
"count": 27,  
"data": {  
"hotspotIdentifier": "00193BECD438",  
"dateStart": "2015-06-03 19:15:48",  
"dateStop": "2015-06-03 19:16:17",  
"sessionTime": "30",  
"traffic": 643328,  
"terminateCause": "User-Request",  
"username": "4C0EDC30",  
"macAddressUser": "24fd5214637c",  
"ipAddressUser": "192.168.8.1",  
"venueId": "ff8080814d91f65e014dba30cc091d83",  
"online": false  
},  
"@version": "1",  
"@timestamp": "2016-07-18T13:23:40.444Z",  
"http\_poller\_metadata": {  
"name": "connections",  
"host": "LIN-UBU-64-AMC-FE2",  
"request": {  
"method": "get",  
"url": "[https://api.cloud4wi.com/v2/connections?dateStart=2015-01-01&dateStop=2016-07-01&limit=1000&offset=0&api\_version=v2.0&api\_key=xxxx&api\_secret=xxxx](https://api.cloud4wi.com/v2/connections?dateStart=2015-01-01&dateStop=2016-07-01&limit=1000&offset=0&api_version=v2.0&api_key=xxxx&api_secret=xxxx)"  
},  
"runtime\_seconds": 0.326,  
"code": 200,  
"response\_headers": {  
"server": "nginx",  
"date": "Mon, 18 Jul 2016 13:23:40 GMT",  
"content-type": "application/json",  
"transfer-encoding": "chunked",  
"connection": "keep-alive",  
"vary": "Accept-Encoding",  
"access-control-allow-origin": "\*",  
"access-control-allow-methods": "OPTIONS, GET, POST, DELETE, PUT",  
"access-control-allow-headers": "Content-Type, api\_key, Authorization"  
},  
"response\_message": "OK",  
"times\_retried": 0  
},  
"type": "clod4wi\_connections",  
"tags": [  
"connections"  
]  
},  
"fields": {  
"@timestamp": [  
1468848220444  
]  
}  
}

What am I missing here?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 19, 2016, 3:23pm UTC](https://discuss.elastic.co/t/does-the-data-input-filter-work-on-nested-fields/55765/2 "2016-07-19T15:23:57Z")

</div>

The fields are named dateStart and dateStop but your date filters tries to parse startDate and stopDate.

---

<div class="post-metadata">

**Author:** ![mormor1971](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@mormor1971](https://discuss.elastic.co/u/mormor1971)\
**Post date:** [July 19, 2016, 3:25pm UTC](https://discuss.elastic.co/t/does-the-data-input-filter-work-on-nested-fields/55765/3 "2016-07-19T15:25:45Z")

</div>

Hi Magnus,

Thanks for spotting that, I did find the issue myself but didn't know how to resolve question in here.

But after I corrected the error I can access nested fields from the date filter no problem!

Thanks for your help Magnus.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:47am UTC](https://discuss.elastic.co/t/does-the-data-input-filter-work-on-nested-fields/55765/4 "2017-07-06T04:47:24Z")

</div>