# I need to leave a string field in the date field. I've done several things but I'm not sure how to do it. Follow my files

**URL:** <https://discuss.elastic.co/t/i-need-to-leave-a-string-field-in-the-date-field-ive-done-several-things-but-im-not-sure-how-to-do-it-follow-my-files/266804>\
**Category:** Logstash\
**Created:** [March 10, 2021, 12:29pm UTC](https://discuss.elastic.co/t/i-need-to-leave-a-string-field-in-the-date-field-ive-done-several-things-but-im-not-sure-how-to-do-it-follow-my-files/266804 "2021-03-10T12:29:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![francieliton\_araujo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/francieliton_araujo/32/47771_2.png) [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\
**Post date:** [March 10, 2021, 12:29pm UTC](https://discuss.elastic.co/t/i-need-to-leave-a-string-field-in-the-date-field-ive-done-several-things-but-im-not-sure-how-to-do-it-follow-my-files/266804/1 "2021-03-10T12:29:21Z")

</div>

I need to leave a string field in the date field.

I've done several things but I'm not sure how to do it.

Follow my files.

```auto
input{
 file{
  path => "/etc/logstash/unico/FM099-Registro\ de\ Indisponibilidade\ -\ 2021.xlsx.csv"
  type => "tjce-csv"
  start_position => "beginning"
  #mode => "read"
  #sincedb_path => "NULL"
  #exit_after_readeditar => "true"
 }
}
filter {
 if [type] == "tjce-csv" {
  csv{
   columns => ["host","data","horainicio","horafim","tempodown","problema","ovservador"]
  }
  ruby{
   code => "
    if event.get('problema').nil?
     event.cancel
    end
    if event.get('problema') == 'Motivo'
     event.cancel
    end
   "
  }
  ruby{
   code => "
#a = event.get('data').gsub('/',' ')
    a = event.get('data')
    sep = a.split('/')
#sep.each_index { |x|
#event.set('statusref',b[x])
# }
    dia = sep[0]
    mes = sep[1]
    ano = sep[2]
# dt = ano+'-'+mes+'-'+dia+'T'+event.get('horainicio')+'Z'
  dt = ano+'-'+mes+'-'+dia+' '+event.get('horainicio')
# event.set('t',ano+' '+mes+' '+dia)
# a << ' '
# a << event.get('horainicio')
    event.set('time',dt)
    event.set('time3',{'date' => dt})
# b = a.split('-')
# event.set('bb',b)
# event.set('time2',a.to_datetime)
   "
  }

# mutate {convert => ["time", "date"]}
# date {
# match => ["time", "yyyy-MM-dd HH:mm:ss"]
# }
 }
}

```

```auto
{
  "_index": "XXXXX",
  "_type": "_doc",
  "_id": "D1EKXXXXXO4Y8wz",
  "_version": 1,
  "_score": null,
  "_source": {
    "time3": {
      "date": "2021-24-2 17:14:00"
    },
    "host": "TACTIUM",
    "tempodown": "00:31:00",
    "time": "2021-24-2 17:14:00",
    "message": "TACTIUM,2/24/2021,17:14:00,17:45:00,00:31:00,Central tactium API da Khomp no Tactium parou.,Responsavel Acyr,\r",
    "ovservador": "XXXXX",
    "column8": null,
    "@timestamp": "2021-03-10T12:09:05.488Z",
    "horafim": "17:45:00",
    "horainicio": "17:14:00",
    "path": "/etc/logstash/unico/FM099-Registro de Indisponibilidade - 2021.xlsx.csv",
    "type": "XXXXX",
    "problema": "Central tactium API da Khomp no Tactium parou.",
    "@version": "1",
    "data": "2/24/2021"
  },
  "fields": {
    "@timestamp": [
      "2021-03-10T12:09:05.488Z"
    ]
  },
  "sort": [
    1615378145488
  ]
}

```

I would like this field to be the same as that of the 'time'  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fb95a962a92f6a8fcf71bb62e9a28efeea989fba.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 10, 2021, 3:58pm UTC](https://discuss.elastic.co/t/i-need-to-leave-a-string-field-in-the-date-field-ive-done-several-things-but-im-not-sure-how-to-do-it-follow-my-files/266804/2 "2021-03-10T15:58:09Z")

</div>

If you are saying that you want the [@timestamp] field to have the value from the [time] field then use a date filter

```
date { match => ["[time]", "YYYY-d-M HH:mm:ss" ] }
```

---

<div class="post-metadata">

**Author:** ![francieliton\_araujo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/francieliton_araujo/32/47771_2.png) [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\
**Post date:** [March 10, 2021, 5:12pm UTC](https://discuss.elastic.co/t/i-need-to-leave-a-string-field-in-the-date-field-ive-done-several-things-but-im-not-sure-how-to-do-it-follow-my-files/266804/3 "2021-03-10T17:12:53Z")

</div>

Thanks, I did the procedure and it worked out to put it on @timestamp, however my goal was for it to be a date type field but as a 'time' name

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 10, 2021, 5:15pm UTC](https://discuss.elastic.co/t/i-need-to-leave-a-string-field-in-the-date-field-ive-done-several-things-but-im-not-sure-how-to-do-it-follow-my-files/266804/4 "2021-03-10T17:15:43Z")

</div>

You could try

```
date { match => ["[time]", "YYYY-d-M HH:mm:ss" ] target => "time" }
```

---

<div class="post-metadata">

**Author:** ![francieliton\_araujo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/francieliton_araujo/32/47771_2.png) [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\
**Post date:** [March 11, 2021, 11:43am UTC](https://discuss.elastic.co/t/i-need-to-leave-a-string-field-in-the-date-field-ive-done-several-things-but-im-not-sure-how-to-do-it-follow-my-files/266804/5 "2021-03-11T11:43:31Z")

</div>

Thank you very much! it worked out

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 8, 2021, 11:43am UTC](https://discuss.elastic.co/t/i-need-to-leave-a-string-field-in-the-date-field-ive-done-several-things-but-im-not-sure-how-to-do-it-follow-my-files/266804/6 "2021-04-08T11:43:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.