# How to get the date object substring in logstash filter **URL:** \ **Category:** Logstash\ **Created:** [May 11, 2016, 12:11pm UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760 "2016-05-11T12:11:05Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![baneshbanna](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Post date:** [May 11, 2016, 12:11pm UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/1 "2016-05-11T12:11:05Z")
In Logstash filter i want to use yyyy-mm . I should get yyyy-mm from date object using substring function. How to get the substring of date object in logstash filter Thanks in advance. ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [May 11, 2016, 4:28pm UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/2 "2016-05-11T16:28:41Z")
I invite you to try this logstash configuration : ``` filter { grok { match => { "@timestamp" => "(?[0-9]{4}\-[0-9]{2})"} } } ``` This will store "yyyy-mm" into "month" field ---
**Author:** ![baneshbanna](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Post date:** [May 13, 2016, 6:51am UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/3 "2016-05-13T06:51:25Z")
Thank you very much. It is working. ---
**Author:** ![baneshbanna](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Post date:** [May 13, 2016, 6:54am UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/4 "2016-05-13T06:54:48Z")
Please suggest how to send NULL date value to elasticsearch using logstash. Now null date value going as "null" string. But it should be NULL date. Thank in advance. ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [May 13, 2016, 7:39am UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/5 "2016-05-13T07:39:51Z")
I think the only way to that is : ``` ruby { code => "event['@timestamp'] = nil" } ``` ---
**Author:** ![baneshbanna](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Post date:** [May 14, 2016, 6:54am UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/6 "2016-05-14T06:54:29Z")
Thank you very much.Its working. ---
**Author:** ![baneshbanna](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Post date:** [May 14, 2016, 7:24am UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/7 "2016-05-14T07:24:40Z")
in csv filter quote\_char default value is """ . In my file fields are not enclosed with "(doublequote). But one of the field having "(doublequote). Logstash failed with csv parse failure exception. logstash confisidering "(doublequote) as default value and failing with csv parse failure exception. Please suggest how to avoid this. Thank in advance. ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [May 14, 2016, 8:12am UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/8 "2016-05-14T08:12:47Z")
To avoid csv filter interprets `"` character, I invite you to set a very special char as "quote\_char" option. For example : ``` csv { quote_char => "`" } ``` ---
**Author:** ![baneshbanna](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Post date:** [May 14, 2016, 6:29pm UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/9 "2016-05-14T18:29:09Z")
Above quote used in the mysql queries to escape mysql predefined variables. same query written to log. if i use that quote also csv failure exception displayed. Please suggest another. ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [May 14, 2016, 7:35pm UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/10 "2016-05-14T19:35:38Z")
Ok. Maybe you could use another special char like $ or ; or ¥ 🙂 If you want another solution, tell me. ---
**Author:** ![baneshbanna](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Post date:** [May 15, 2016, 4:18pm UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/11 "2016-05-15T16:18:00Z")
Please tell me another solution. ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [May 16, 2016, 5:35pm UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/12 "2016-05-16T17:35:25Z")
OK, so the other solution aims to transform your log line to a standard csv line. These are the logstash filters to set before csv filter : ``` mutate { gsub => ['message', '"', '""'] } mutate { gsub => ['message', ',', '","'] } mutate { replace => { 'message' => '"%{message}"' } } ``` ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [May 18, 2016, 6:49am UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/14 "2016-05-18T06:49:13Z")
It is a really different subject, so I invite you to open a new topic for that. ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [June 13, 2016, 7:31am UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/16 "2016-06-13T07:31:53Z")
One more time, that's a different subject, so I invite you to open a new topic. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/how-to-get-the-date-object-substring-in-logstash-filter/49760/17 "2017-07-06T04:53:25Z")