# Filter "Date" not applying to @timestamp

**URL:** https://discuss.elastic.co/t/filter-date-not-applying-to-timestamp/176566
**Category:** Logstash
**Created:** [April 12, 2019, 7:51am UTC](https://discuss.elastic.co/t/filter-date-not-applying-to-timestamp/176566 "2019-04-12T07:51:06Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Victor\_Krot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_krot/32/44005_2.png) [@Victor\_Krot](https://discuss.elastic.co/u/Victor_Krot)
#### Post date: [April 12, 2019, 7:51am UTC](https://discuss.elastic.co/t/filter-date-not-applying-to-timestamp/176566/1 "2019-04-12T07:51:06Z")

</div>

Hi!  
Seen a lot of topics about converting date from custom log's strings. None of them helped me.  
I have a string like this for example:  
`2019-04-11 07:36:27.842	-	14292	Information	Interceptor	Organization protection refreshing was started: .`

I had successfully extract date from it with Grok:  
`(?<mytimestamp>^[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3})`

But with date filter I cannot send it to target field @timestamp

Here is the filter:

```
filter {
grok {
match => { "message" => "(?<mytimestamp>^[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3})" }
}
date {
locale => "eng-US-POSIX"
match => ["mytimestamp", "yyyy-MM-dd HH:mm:ss.SSS"]
timezone => "Europe/Moscow"
}
}

```

What am I doing wrong?  
Elastic and logstash version 6.7.1

---

<div class="post-metadata">

### Author: ![Victor\_Krot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_krot/32/44005_2.png) [@Victor\_Krot](https://discuss.elastic.co/u/Victor_Krot)
#### Post date: [April 12, 2019, 8:26am UTC](https://discuss.elastic.co/t/filter-date-not-applying-to-timestamp/176566/2 "2019-04-12T08:26:45Z")

</div>

Ok! I figured it out. It is because filtered time was in original format (UTC) and it is was far from the time range I selected.  
Now I am getting my time into @timestamp.  
But still I cannot convert in to my Timezone.  
I guess I have to mutate it and after apply timezone - but how to do it right?

---

<div class="post-metadata">

### Author: ![Victor\_Krot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_krot/32/44005_2.png) [@Victor\_Krot](https://discuss.elastic.co/u/Victor_Krot)
#### Post date: [April 12, 2019, 9:20am UTC](https://discuss.elastic.co/t/filter-date-not-applying-to-timestamp/176566/3 "2019-04-12T09:20:15Z")

</div>

Now I resolved the issue with timezone forcly defined it in Date filter as UTC and Kibana do Timezone converting on the fly.  
(my log time also comes with UTC, but logstash didn't get it as such ☹ )  
date {  
locale =\> "eng-US-POSIX"  
match =\> ["time", "yyyy-MM-dd HH:mm:ss.SSS"]  
timezone =\> "UTC"  
}  
}

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 10, 2019, 9:20am UTC](https://discuss.elastic.co/t/filter-date-not-applying-to-timestamp/176566/4 "2019-05-10T09:20:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.