# Logstash date filter in string format for input 150M

**URL:** <https://discuss.elastic.co/t/logstash-date-filter-in-string-format-for-input-150m/127415>\
**Category:** Logstash\
**Created:** [April 10, 2018, 4:58am UTC](https://discuss.elastic.co/t/logstash-date-filter-in-string-format-for-input-150m/127415 "2018-04-10T04:58:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pcouas](https://avatars.discourse-cdn.com/v4/letter/p/7cd45c/32.png) [@pcouas](https://discuss.elastic.co/u/pcouas)\
**Post date:** [April 10, 2018, 4:58am UTC](https://discuss.elastic.co/t/logstash-date-filter-in-string-format-for-input-150m/127415/1 "2018-04-10T04:58:20Z")

</div>

Hi

My logstash filter logdate is converted to "string" field and not to "date" field, if all my log rotated field are more 150 Mo ?  
An idea ?

Regards  
Phil  
logstash 5.6.8

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 10, 2018, 6:03am UTC](https://discuss.elastic.co/t/logstash-date-filter-in-string-format-for-input-150m/127415/2 "2018-04-10T06:03:44Z")

</div>

> if all my log rotated field are more 150 Mo ?

I have no idea what you mean by this.

What does your configuration look like? What does an example event produced by Logstash look like? Use a `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

**Author:** ![pcouas](https://avatars.discourse-cdn.com/v4/letter/p/7cd45c/32.png) [@pcouas](https://discuss.elastic.co/u/pcouas)\
**Post date:** [April 10, 2018, 4:48pm UTC](https://discuss.elastic.co/t/logstash-date-filter-in-string-format-for-input-150m/127415/3 "2018-04-10T16:48:30Z")

</div>

Hi

My logstash configuation file is

input {  
file {  
type =\> "static"  
path =\> "/home/elasticsearch/static\_logs/_Web.log" exclude =\> "_.zip"  
start\_position =\> beginning  
sincedb\_path =\> "/dev/null"   
}  
}

filter {  
if [type] == "static" {  
if [message] !~ /(.+)/ {  
drop { }  
}  
grok{  
patterns\_dir =\> "./patterns"  
overwrite =\> ["message"]  
# 2017-08-07 11:47:35,466 INFO [http-bio-10.60.2.19-10267-exec-60] jsch.DeployManagerFileUSImpl (DeployManagerFileUSImpl.java:155) - Deconnexion de l'hote qvirmqa3  
# 2017-08-07 11:47:51,775 ERROR [http-bio-10.60.2.19-10267-exec-54] service.BindingsRSImpl (BindingsRSImpl.java:143) - Can't find bindings file deployed on server  
# 2017-08-03 16:01:11,352 WARN [Thread-552] pcf2.AbstractObjetMQDAO (AbstractObjetMQDAO.java:137) - Descripteur de  
match =\> ["message", "%{TIMESTAMP\_ISO8601:logdate},%{INT} %{LOGLEVEL:logLevel} [(?[^]]+)] %{JAVACLASS:package} (%{JAVAFILE:className}:%{INT:line}) - %{GREEDYDATA:message}" ]  
}  
# 2017-08-03 16:01:11,352  
date{  
match =\> ["logdate", "YYYY-MM-dd hh:mm:ss"]  
target =\> "logdate"  
}  
}  
}

output {  
elasticsearch { hosts =\> ["192.168.99.100:9200"]}  
}

Regards

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 10, 2018, 6:05pm UTC](https://discuss.elastic.co/t/logstash-date-filter-in-string-format-for-input-150m/127415/4 "2018-04-10T18:05:38Z")

</div>

If logdate starts as the string "2017-08-07 11:47:51" then you get

```auto
       "logdate" => 2017-08-07T15:47:51.000Z,

```

However, if it starts as "2017-08-07 16:01:11" then you get

```auto
       "logdate" => "2017-08-07 16:01:11"

```

Update your date filter to use HH instead of hh.

```auto
date { match => ["logdate" , "YYYY-MM-dd HH:mm:ss"] target => "logdate" }

```

---

<div class="post-metadata">

**Author:** ![pcouas](https://avatars.discourse-cdn.com/v4/letter/p/7cd45c/32.png) [@pcouas](https://discuss.elastic.co/u/pcouas)\
**Post date:** [April 11, 2018, 11:29am UTC](https://discuss.elastic.co/t/logstash-date-filter-in-string-format-for-input-150m/127415/5 "2018-04-11T11:29:59Z")

</div>

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 9, 2018, 11:30am UTC](https://discuss.elastic.co/t/logstash-date-filter-in-string-format-for-input-150m/127415/6 "2018-05-09T11:30:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.