# Drop/cancel events with a timestamp older than a given amount of seconds

**URL:** https://discuss.elastic.co/t/drop-cancel-events-with-a-timestamp-older-than-a-given-amount-of-seconds/174608
**Category:** Logstash
**Created:** [March 29, 2019, 9:03pm UTC](https://discuss.elastic.co/t/drop-cancel-events-with-a-timestamp-older-than-a-given-amount-of-seconds/174608 "2019-03-29T21:03:56Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![jcaballero](https://avatars.discourse-cdn.com/v4/letter/j/278dde/32.png) [@jcaballero](https://discuss.elastic.co/u/jcaballero)
#### Post date: [March 29, 2019, 9:03pm UTC](https://discuss.elastic.co/t/drop-cancel-events-with-a-timestamp-older-than-a-given-amount-of-seconds/174608/1 "2019-03-29T21:03:56Z")

</div>

LogStash 6.6

My log files have lines like this

```
01/07/19 18:31:33.452 blah blah blah

```

where the time is local.

I need to discard all lines older than a given amount of time. Let's say, for example, 24 hours.  
I have a grok filter to capture the timestamp into a variable:

```
grok {
    pattern_definitions => { "START_TIMESTAMP" => "%{DATE_US} %{TIME}" }
    match => { "message" => [
        '^%{START_TIMESTAMP:eventtimestamp}',
        ... <other patterns here> ...
   }
}

```

After that, I do a lot of filtering within the Ruby filter.  
So I was wondering if I can, somehow, check how old is the content of "eventtimestamp", and perform event.cancel if needed.

Reading similar posts, I believe they suggest to convert it first using filter date, so I tried something like this

```
date {
    match => ["eventtimestamp", "MM/dd/yy HH:mm:ss.SSS"]
    target => "eventtimestamp"
}

```

but it is unclear to me what to do with it after that inside by Ruby filter code. Something like this

```
if ( Time.now - event.get("eventtimestamp") ) > 86400
    event.cancel
end

```

does not work, as it seems to be comparing Timestamp and Rational objects.  
What am I missing here? Most probably something trivial I don't see as I am 100% new to Ruby... 🙂

Or maybe it is easier to do it using pure LogStash comparisons, before entering the filter plugin?

Thanks a lot in advance.  
Jose

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 30, 2019, 7:08am UTC](https://discuss.elastic.co/t/drop-cancel-events-with-a-timestamp-older-than-a-given-amount-of-seconds/174608/2 "2019-03-30T07:08:05Z")

</div>

Once you have parsed the log timestamp into `@timestamp` using the date filter you can use the [age filter](https://github.com/logstash-plugins/logstash-filter-age) to calculate age and base your drop decision on this.

---

<div class="post-metadata">

### Author: ![jcaballero](https://avatars.discourse-cdn.com/v4/letter/j/278dde/32.png) [@jcaballero](https://discuss.elastic.co/u/jcaballero)
#### Post date: [March 30, 2019, 6:43pm UTC](https://discuss.elastic.co/t/drop-cancel-events-with-a-timestamp-older-than-a-given-amount-of-seconds/174608/3 "2019-03-30T18:43:55Z")

</div>

Hi, Crhistian,  
my understanding is that Age filter is not available anymore in LogStash 6.x

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 30, 2019, 7:40pm UTC](https://discuss.elastic.co/t/drop-cancel-events-with-a-timestamp-older-than-a-given-amount-of-seconds/174608/4 "2019-03-30T19:40:55Z")

</div>

You can use

```
if ( Time.now.to_i - event.get("eventtimestamp").to_i ) > 86400
    event.cancel
end
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 27, 2019, 7:40pm UTC](https://discuss.elastic.co/t/drop-cancel-events-with-a-timestamp-older-than-a-given-amount-of-seconds/174608/5 "2019-04-27T19:40:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.