# HELP! I want to split date. using split filter

**URL:** <https://discuss.elastic.co/t/help-i-want-to-split-date-using-split-filter/156273>\
**Category:** Logstash\
**Created:** [November 12, 2018, 10:19am UTC](https://discuss.elastic.co/t/help-i-want-to-split-date-using-split-filter/156273 "2018-11-12T10:19:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![levi\_munthe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/levi_munthe/32/42202_2.png) [@levi\_munthe](https://discuss.elastic.co/u/levi_munthe)\
**Post date:** [November 12, 2018, 10:19am UTC](https://discuss.elastic.co/t/help-i-want-to-split-date-using-split-filter/156273/1 "2018-11-12T10:19:01Z")

</div>

2018-08-28 08:08:05 172.168.0.100 GET / - 80 - 66.249.71.153 Mozilla/5.0+(compatible;+Googlebot/2.1;++http://www.google.com/bot.html) - 200 0 0 13453

Filter.

filter {

grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:date} %{IP:client} %{WORD:method} %{GREEDYDATA:request} %{NUMBER:port} - %{IP:ip} %{WORD:agent}/%{NUMBER:version}%{GREEDYDATA:refere} %{NUMBER:statuscode} %{NUMBER:substatus} %{NUMBER:winstatus} %{NUMBER:duration}"}  
}

geoip {  
source =\> "ip"  
}

date {  
match =\> ["date" , "yyyy-MM-dd HH:mm:ss"]  
target =\> "date"  
}

split {  
field =\> "date"  
add\_field =\> {"[month]" =\> "%{+M}"}  
add\_field =\> {"[day]" =\> "%{+d}"}  
add\_field =\> {"[hour]" =\> "%{+H}"}  
}  
}

Halo, I want to know if logstash can split date into year month day hour, but from the message not convert it from filter date function because the date often not match cause the timezone different.  
i want to split the date 2018-08-28 08:08:05 into date : 2018-08-28 08:08:05, Y : 2018, M: 08, D:28, H: 08, Minute : 08, S: 05 like this. can we use split filter to split it?. Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 10, 2018, 10:19am UTC](https://discuss.elastic.co/t/help-i-want-to-split-date-using-split-filter/156273/2 "2018-12-10T10:19:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.