# Harvest logs between a certain date

**URL:** https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194
**Category:** Beats
**Tags:** filebeat
**Created:** [September 19, 2018, 9:12pm UTC](https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194 "2018-09-19T21:12:49Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![mgreco2k](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@mgreco2k](https://discuss.elastic.co/u/mgreco2k)
#### Post date: [September 19, 2018, 9:12pm UTC](https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194/1 "2018-09-19T21:12:49Z")

</div>

I want filebeat to harvest logs that have a date between 9/14/2018 @ 12:00:00 to 9/17/2018 @ 18:00:00 and I'm not sure how to do that ?

---

<div class="post-metadata">

### Author: ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [September 20, 2018, 11:12am UTC](https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194/2 "2018-09-20T11:12:35Z")

</div>

Hi @mgreco2k

You could use the range condition if you previously convert the dates to and integer or float value [https://www.elastic.co/guide/en/beats/filebeat/master/defining-processors.html#conditions](https://www.elastic.co/guide/en/beats/filebeat/master/defining-processors.html#conditions)

---

<div class="post-metadata">

### Author: ![mgreco2k](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@mgreco2k](https://discuss.elastic.co/u/mgreco2k)
#### Post date: [September 20, 2018, 12:04pm UTC](https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194/3 "2018-09-20T12:04:54Z")

</div>

Mario the time that I'm talking about is the time on the file itself ... the messages in the file have no timestamps on them ... and they are all files created between 9/14/2018 @ 12:00:00 to 9/17/2018 @ 18:00:00

I'm sure elastic has had customers that inadvertently blown away a day of an index in the past and needed that data resent to rebuild that days index ... how was that accomplished?

---

<div class="post-metadata">

### Author: ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [September 21, 2018, 9:54am UTC](https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194/4 "2018-09-21T09:54:03Z")

</div>

Ahm, I'm afraid that it's not currently possible. I can't think in any alternative right now

---

<div class="post-metadata">

### Author: ![mgreco2k](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@mgreco2k](https://discuss.elastic.co/u/mgreco2k)
#### Post date: [September 21, 2018, 1:07pm UTC](https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194/5 "2018-09-21T13:07:33Z")

</div>

Thank you Mario ... I appreciate that cause I hunted to find an answer on this one. Do you know how to get this type of problem logged as a feature request for the future ?

---

<div class="post-metadata">

### Author: ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [September 21, 2018, 1:21pm UTC](https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194/6 "2018-09-21T13:21:24Z")

</div>

Sure, just file us a request here [https://github.com/elastic/beats/issues](https://github.com/elastic/beats/issues), link this thread and we'll examine it. I agree that it could be a nice addition.

We also encourage the community to contribute by solving their own issues. 😉

---

<div class="post-metadata">

### Author: ![mgreco2k](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@mgreco2k](https://discuss.elastic.co/u/mgreco2k)
#### Post date: [September 21, 2018, 1:37pm UTC](https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194/7 "2018-09-21T13:37:50Z")

</div>

does this look good to you Mario ?

> <https://github.com/elastic/beats/issues/8388>

I figure you know more about submitting issues than I do ...

Thank you again for your kindness. I spent way too much time blaming myself for an answer on this one.

---

<div class="post-metadata">

### Author: ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [September 21, 2018, 1:54pm UTC](https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194/8 "2018-09-21T13:54:11Z")

</div>

Sure, I've added a couple of tags already.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 19, 2018, 1:54pm UTC](https://discuss.elastic.co/t/harvest-logs-between-a-certain-date/149194/9 "2018-10-19T13:54:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
