# How to convert a list of string to a list of date in filter?

**URL:** https://discuss.elastic.co/t/how-to-convert-a-list-of-string-to-a-list-of-date-in-filter/47886
**Category:** Logstash
**Created:** [April 20, 2016, 9:37am UTC](https://discuss.elastic.co/t/how-to-convert-a-list-of-string-to-a-list-of-date-in-filter/47886 "2016-04-20T09:37:50Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Morriaty](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Morriaty](https://discuss.elastic.co/u/Morriaty)
#### Post date: [April 20, 2016, 9:37am UTC](https://discuss.elastic.co/t/how-to-convert-a-list-of-string-to-a-list-of-date-in-filter/47886/1 "2016-04-20T09:37:50Z")

</div>

The input had a field named `valid_dates` which is a string column from mysql(jdbc).It formatted like this

```auto
"2014-09-10 00:00:00,2014-08-21 17:02:02,2014-06-19 00:00:00,2014-08-20 14:29:09"

```

And the filter was

```json
filter {
    mutate => {
        split => { "valid_dates" => "," }
    }
    ruby {
            code => "require 'date'
                    # I also tried this, failed too.
                    # event['valid_dates']=event['valid_dates'].split(",")
                    event['valid_dates']=event['valid_dates'].map {|dt| Datetime.strptime(dt,'%Y-%m-%d %H:%M:%S')}"
    }
}

```

The error was

```auto
Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::Datetime {:level=>:error}
Ruby exception occurred: undefined method `map' for nil:NilClass {:level=>:error}
Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::Datetime {:level=>:error}
Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::Datetime {:level=>:error}
Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::Datetime {:level=>:error}
Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::Datetime {:level=>:error}
Ruby exception occurred: undefined method `map' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `map' for nil:NilClass {:level=>:error}

```

BTW, I wanna know if logstash filter could support python or some other script languages.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 20, 2016, 9:47am UTC](https://discuss.elastic.co/t/how-to-convert-a-list-of-string-to-a-list-of-date-in-filter/47886/2 "2016-04-20T09:47:36Z")

</div>

I believe the class is named DateTime, not Datetime.

> BTW, I wanna know if logstash filter could support python or some other script languages.

I don't think that's very likely.

---

<div class="post-metadata">

### Author: ![Morriaty](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Morriaty](https://discuss.elastic.co/u/Morriaty)
#### Post date: [April 20, 2016, 10:47am UTC](https://discuss.elastic.co/t/how-to-convert-a-list-of-string-to-a-list-of-date-in-filter/47886/3 "2016-04-20T10:47:57Z")

</div>

Thank you @magnusbaeck. I've corrected the mistake. But it still failed.

Here are what I've tried  
The pipeline was `input(jdbc) - filter(mutate/ruby) - output(es)`

- Split the `valid_dates` string in filter and specify the mappings template in output es

```auto
filter {
    mutate {
        split => { "valid_dates" => "," }
    }
}
output {
    elasticsearch {
        index => "newmall"
        document_type => "shop"
        document_id => "%{docid}"
        template => "/home/es/logstash-2.2.2/bin/templates/newmall.json"
        hosts => "10.10.20.143:9201"
   }
}

```

And the template

```auto
{
  "template": "newmall",
  "mappings": {
    "shop": {
      "properties": {
        "valid_dates": {
          "type": "date"
        }
      }
    }
  }

```

But at last the type of `valid_dates` in es was string.

- Use both mutate and ruby in filter

```json
filter {
    mutate => {
        split => { "valid_dates" => "," }
    }
    ruby {
            code => "require 'date'
                    event['valid_dates']=event['valid_dates'].map {|dt| DateTime.strptime(dt,'%Y-%m-%d %H:%M:%S')}"
    }
}

```

The error was

```auto
Ruby exception occurred: undefined method `map' for nil:NilClass {:level=>:error}
Ruby exception occurred: invalid date {:level=>:error}
Ruby exception occurred: invalid date {:level=>:error}
Ruby exception occurred: undefined method `map' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `map' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `map' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `map' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `map' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `map' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `map' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `map' for nil:NilClass {:level=>:error}

```

It seemed that `valid_dates` didn't turn into array, and was recognized as null.

- Use ruby only

```auto
ruby {
            code => "require 'date'
                    event['valid_dates']=event['valid_dates'].split(',')
                    event['valid_dates']=event['valid_dates'].map {|dt| DateTime.strptime(dt,'%Y-%m-%d %H:%M:%S')}"
    }

```

The error was

```auto
Ruby exception occurred: undefined method `split' for nil:NilClass {:level=>:error}
Ruby exception occurred: invalid date {:level=>:error}
Ruby exception occurred: invalid date {:level=>:error}
Ruby exception occurred: undefined method `split' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `split' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `split' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `split' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `split' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `split' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `split' for nil:NilClass {:level=>:error}
Ruby exception occurred: undefined method `split' for nil:NilClass {:level=>:error}

```

It seemed that ruby has recognized `valid_dates` as null. But in the first condition the mutate filter has split the field correctly.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 20, 2016, 11:05am UTC](https://discuss.elastic.co/t/how-to-convert-a-list-of-string-to-a-list-of-date-in-filter/47886/4 "2016-04-20T11:05:41Z")

</div>

What does the event look like? Use a `stdout { codec => rubydebug }` output to find out.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/how-to-convert-a-list-of-string-to-a-list-of-date-in-filter/47886/5 "2017-07-06T05:01:29Z")

</div>


