# Ignore date offset in logstash

**URL:** <https://discuss.elastic.co/t/ignore-date-offset-in-logstash/123419>\
**Category:** Logstash\
**Created:** [March 11, 2018, 9:03am UTC](https://discuss.elastic.co/t/ignore-date-offset-in-logstash/123419 "2018-03-11T09:03:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\
**Post date:** [March 11, 2018, 9:03am UTC](https://discuss.elastic.co/t/ignore-date-offset-in-logstash/123419/1 "2018-03-11T09:03:03Z")

</div>

HI, I have the following date format:  
"2017-12-01 04:39:34-04:000"

Currently, I use this configuration:

```
date{
                match => ["[documentsList][0][commandTimestamp]","yyyy-MM-dd HH:mm:ssZZ'0'"]
                target => ["command_timestamp"]
                remove_field => ["%{timestamp}"]
        }

```

Now I want to ignore the date offset, i.e. ignore the "-04:000".  
When I try to change the configuration to:

```
date{
                match => ["[documentsList][0][commandTimestamp]","yyyy-MM-dd HH:mm:ss"]
                target => ["command_timestamp"]
                remove_field => ["%{timestamp}"]
        }

```

I get date parse failure.  
Why is this happening? How can I fix it?

---

<div class="post-metadata">

**Author:** ![immavalls](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/immavalls/32/146501_2.png) [@immavalls](https://discuss.elastic.co/u/immavalls)\
**Post date:** [March 11, 2018, 9:25am UTC](https://discuss.elastic.co/t/ignore-date-offset-in-logstash/123419/2 "2018-03-11T09:25:12Z")

</div>

This might help: [Want to capture timeStamp without milliseconds](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389).

---

<div class="post-metadata">

**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\
**Post date:** [March 11, 2018, 12:25pm UTC](https://discuss.elastic.co/t/ignore-date-offset-in-logstash/123419/3 "2018-03-11T12:25:38Z")

</div>

HI, Thanks for the answer.  
I tried:

```
    mutate{
            copy => {"[documentsList][0][commandTimestamp]" => "[documentsList][0][noffset_commandTimestamp]"}

            gsub => ["[documentsList][0][noffset_commandTimestamp]","/.{8}$/g",""]
    }

    date{
            match => ["[documentsList][0][noffset_commandTimestamp]","yyyy-MM-dd HH:mm:ss"]
            target => ["no_offset_command_timestamp"]
    }

```

and the no offset timestamp remain unchanged.  
I tried also in the gsub line:  
/-\d{2}+:\d{3}/g

to no avial.  
I tried also without the "/" on the start and "/g" in the end. Same result.

Any advice?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 11, 2018, 7:34pm UTC](https://discuss.elastic.co/t/ignore-date-offset-in-logstash/123419/4 "2018-03-11T19:34:00Z")

</div>

Don't assume that the options to a mutate filter execute in the order given. They always execute in a fixed order:

> <https://github.com/logstash-plugins/logstash-filter-mutate/blob/v3.3.1/lib/logstash/filters/mutate.rb#L247-L265>

So, gsub runs before copy. Split your mutate filter in two. Secondly, the gsub expression is wrong. Try this:

```
gsub => ["[documentsList][0][noffset_commandTimestamp]", ".{8}$", ""]
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 8, 2018, 7:34pm UTC](https://discuss.elastic.co/t/ignore-date-offset-in-logstash/123419/5 "2018-04-08T19:34:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.