# Impossible format date **URL:** \ **Category:** Logstash\ **Created:** [January 30, 2019, 12:41pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355 "2019-01-30T12:41:38Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Viti](https://avatars.discourse-cdn.com/v4/letter/v/9f8e36/32.png) [@Viti](https://discuss.elastic.co/u/Viti)\ **Post date:** [January 30, 2019, 12:41pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/1 "2019-01-30T12:41:38Z")
Hello, I need to format a date. The log line is this: 2019-01-29 12:59:51,8345358246519 ERROR - RGKAS055551 \* INFO \* 00003 \* method \* initSystem \* =====\> fail system down I have this: 2019-01-29 12:59:51,8345358246519 and I want this: 2019-01-29 12:59:51,834 (This information will send to elasticsearch) I need to save as a date field. How can I make it? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 30, 2019, 1:36pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/2 "2019-01-30T13:36:28Z")
> [@Viti](#): > > 2019-01-29 12:59:51,8345358246519 You can extract the first 23 characters of a string using ``` mutate { gsub => ["ts", "^(.{23}).*", "\1"] } ``` ---
**Author:** ![Viti](https://avatars.discourse-cdn.com/v4/letter/v/9f8e36/32.png) [@Viti](https://discuss.elastic.co/u/Viti)\ **Post date:** [January 30, 2019, 2:42pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/3 "2019-01-30T14:42:50Z")
Yes, it works, but it only got a string of 23 characters. Now I have this: 2019-01-29 12:59:51,834 I want to send to Elasticsearch a DATE field or some kind of field for I can do filter with Dates What do I need? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 30, 2019, 2:50pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/4 "2019-01-30T14:50:06Z")
> [@Viti](#): > > 2019-01-29 12:59:51,834 Use a date filter. That format fits the ISO8601 pattern. ``` date { match => ["ts", "ISO8601"] } ``` That will modify the @timestamp field. ---
**Author:** ![Viti](https://avatars.discourse-cdn.com/v4/letter/v/9f8e36/32.png) [@Viti](https://discuss.elastic.co/u/Viti)\ **Post date:** [January 30, 2019, 3:38pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/5 "2019-01-30T15:38:35Z")
Elasticsearch always get that field like a String. I don't understand because It has this performances ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 30, 2019, 3:53pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/6 "2019-01-30T15:53:39Z")
Elasticsearch has @timestamp mapped as a string? You might want to try creating a new index and see if it works in that. ---
**Author:** ![Viti](https://avatars.discourse-cdn.com/v4/letter/v/9f8e36/32.png) [@Viti](https://discuss.elastic.co/u/Viti)\ **Post date:** [February 4, 2019, 12:07pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/7 "2019-02-04T12:07:22Z")
now I have the date: 2019-01-29T12:59:51.834 (12:59) When it saved to elasticsearch 2019-01-29T11:59:51.834 (11:59) Why is ocurring this? I think that I need the time zone How do it make? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [February 4, 2019, 12:51pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/8 "2019-02-04T12:51:44Z")
All timestamps in Elasticsearch are in UTC timezone, so depending on which time zone you are in this may be correct. ---
**Author:** ![Viti](https://avatars.discourse-cdn.com/v4/letter/v/9f8e36/32.png) [@Viti](https://discuss.elastic.co/u/Viti)\ **Post date:** [February 4, 2019, 2:17pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/9 "2019-02-04T14:17:27Z")
I send the current hour and elasticsearch saves one hour more How do I change it in elastisearch?. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [February 4, 2019, 2:35pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/10 "2019-02-04T14:35:04Z")
Which time zone are you in? Are the timestamps in the logs in local time? ---
**Author:** ![Viti](https://avatars.discourse-cdn.com/v4/letter/v/9f8e36/32.png) [@Viti](https://discuss.elastic.co/u/Viti)\ **Post date:** [February 4, 2019, 2:42pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/11 "2019-02-04T14:42:42Z")
I work with time zone of Europa Madrid. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [February 4, 2019, 3:02pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/12 "2019-02-04T15:02:01Z")
Then it looks correct as 12:59 CET corresponds to 11:59 UTC. Elasticsearch requires all timestamps to be in UTC, and Kibana will translate to the local timezone where applicable, although it will not change the source of the document. ---
**Author:** ![Viti](https://avatars.discourse-cdn.com/v4/letter/v/9f8e36/32.png) [@Viti](https://discuss.elastic.co/u/Viti)\ **Post date:** [February 4, 2019, 3:36pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/13 "2019-02-04T15:36:51Z")
> [@Christian\_Dahlqvist](#): > > 9 UTC The register always saves with a hour more. For example I have a register with date 2019-01-29T23:00:51.834 Elasticsearhc saves: 2019-01-30T00:00:51.834 (I have and hour more and it is next day) I want to save 2019-01-29T23:00:51.834 ---
**Author:** ![Viti](https://avatars.discourse-cdn.com/v4/letter/v/9f8e36/32.png) [@Viti](https://discuss.elastic.co/u/Viti)\ **Post date:** [February 4, 2019, 3:50pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/14 "2019-02-04T15:50:58Z")
Finally I change the parameter in Kibana -\> Management -\>advanced settings ![Kibana%20-%20Mozilla%20Firefox](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7e9d8f58a19779c5b38c04afd1f30a5a651f37c4.jpeg) Thank you very much ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 4, 2019, 3:50pm UTC](https://discuss.elastic.co/t/impossible-format-date/166355/15 "2019-03-04T15:50:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.