# Logstash date filter issue with kibana/elasticsearch

**URL:** https://discuss.elastic.co/t/logstash-date-filter-issue-with-kibana-elasticsearch/236383
**Category:** Elastic Stack
**Created:** [June 9, 2020, 4:03pm UTC](https://discuss.elastic.co/t/logstash-date-filter-issue-with-kibana-elasticsearch/236383 "2020-06-09T16:03:22Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![damasu](https://avatars.discourse-cdn.com/v4/letter/d/c89c15/32.png) [@damasu](https://discuss.elastic.co/u/damasu)
#### Post date: [June 9, 2020, 4:03pm UTC](https://discuss.elastic.co/t/logstash-date-filter-issue-with-kibana-elasticsearch/236383/1 "2020-06-09T16:03:22Z")

</div>

Hi,

I am having a very strange issue here.

For instance, when i include the date filter in my code

```auto
      if [fields][document_type] == "mvpep" {
    grok {
      match => { "message" => "(%{TIMESTAMP_ISO8601:timestamp_event}(%{SPACE}%{SPACE}|%{SPACE})%{NUMBER:request_ID}%{SPACE}\[%{GREEDYDATA:java_thread}\] %{LOGLEVEL:log_level} (?<java_class>[a-zA-Z.]+):%{NUMBER:code_line} - (((%{WORD:method}|%{WORD:method}\(%{NUMBER:instances}\)): %{WORD:http_type} - %{URI:info})|%{GREEDYDATA:random_data})|%{TIMESTAMP_ISO8601:timestamp_event}(%{SPACE}%{SPACE}|%{SPACE})%{LOGLEVEL:log_level}%{SPACE}\[(([,]{3})|(?<java_thread>[A-Za-z0-9\-,.]+))\]%{SPACE}([?\-]{3,4})%{SPACE}([?\-]{3,4})%{SPACE}\[(?<runtime>[A-Za-z0-9\-\[\]\s]+)\]%{SPACE}(?<java_class>[A-Za-z0-9.\s]+):%{SPACE}((%{WORD:process}|%{WORD:process}\(%{NUMBER:executed_time}\)|%{WORD:process}%{SPACE:space_exists}\(%{NUMBER:executed_time}\))(:|%{SPACE}[>-]+)( %{WORD:http_type} - %{URI:info}|%{SPACE}(?<java_type>[A-Za-z]+)%{SPACE}(?<java_method>[A-Za-z.,\s\[\]\(\)]+)\|%{GREEDYDATA}\|(?<java_user>[A-Z\s]+)\|%{GREEDYDATA})|%{GREEDYDATA:event_message}))" }
      add_tag => ["grok", "mvpep"]
    }
    if [space_exists] {
      mutate {
        add_field => { "internal" => 1 }
        remove_field => ["space_exists"]
      }
    } else {
      mutate {
        add_field => { "internal" => 0 }
      }
    }
    mutate {
      strip => ["java_class", "runtime", "java_method", "java_type", "java_user"]
      convert => {
        "executed_time" => "integer"
        "internal" => "boolean"
      }
    }
    if [java_method] and [executed_time] {
      ruby {
        code => "zabbix_key = event.get('java_method').split('(')[0];
                 zabbix_key = 'trapper.key[' + zabbix_key + ']';
                 event.set('zabbix_key',zabbix_key)
                "
      }
    }
    date {
      match => ["timestamp_event", "YYYY-MM-dd HH:mm:ss.SSS", "YYYY-MM-dd HH:mm:ss.SS", "YYYY-MM-dd HH:mm:ss.S"]
    }
  }

```

i can see that in the logstash output that the @timestamp is updated accordingly.

```auto
logstash | "timestamp_event" => "2020-06-09 12:51:07.143",
logstash | "@timestamp" => 2020-06-09T12:51:07.143Z,

```

but the information does not show in kibana timeline!!!

Any idea why this is occurring?

I reseted the index and updated/remade the index pattern yet the problem persists. I use the date filter in other parts of my logstash.conf and it works! I have a feeling this is an issue with the format of the timestamp\_event. I am not receving a \_dateparsefailure either. simply nothing appears.

As an example where it works

```auto
  if [fields][document_type] == "secure" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:timestamp_event} %{HOSTNAME:hostname} %{GREEDYDATA:event_output}" }
      add_tag => ["grok", "secure"]
    }
    date {
      locale => en
      match => ["timestamp_event", "MMM d HH:mm:ss", "MMM dd HH:mm:ss", "MMM d HH:mm:ss"]
    }
  }

```

I am seeing this in the elasticsearch logs. I do not know if this is related.

```auto
es01 | {"type": "deprecation", "timestamp": "2020-06-09T16:51:01,397Z", "level": "WARN", "component": "o.e.d.s.a.b.h.DateHistogramAggregationBuilder", "cluster.name": "es-docker-cluster", "node.name": "es01", "message": "[interval] on [date_histogram] is deprecated, use [fixed_interval] or [calendar_interval] in the future.", "cluster.uuid": "2IK2zt_wRCSfBJKOwZvW9A", "node.id": "PCefJvWCTVSrvcih66fKBg" }

```

I will investigate this error more.

RESOLVED. timezone needs to be used here.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 8:01am UTC](https://discuss.elastic.co/t/logstash-date-filter-issue-with-kibana-elasticsearch/236383/2 "2022-11-04T08:01:47Z")

</div>