# Logstash date filter match timestamp issue

**URL:** <https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506>\
**Category:** Logstash\
**Created:** [July 16, 2020, 4:30pm UTC](https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506 "2020-07-16T16:30:08Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![rahulnama](https://avatars.discourse-cdn.com/v4/letter/r/8c91f0/32.png) [@rahulnama](https://discuss.elastic.co/u/rahulnama)\
**Post date:** [July 16, 2020, 4:30pm UTC](https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506/1 "2020-07-16T16:30:08Z")

</div>

Hi Team

**I want to match the timestamp with date from logs. But in kibana I see different time for timestamp and logdate. why is this happening and how to resolve this ?**

Kibana data

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/6/b6e66fa11c502f88f64c3897debe196e15478530.png)

Logstash.conf

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/7/87103045dbff40c4a8286b622497a1e8794e3347.png)

Any suggestions would be helpful.

Thank you

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 16, 2020, 5:40pm UTC](https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506/2 "2020-07-16T17:40:55Z")

</div>

Dates in elasticsearch are always stored as UTC. kibana will transform them into the local timezone. If the dates in your logfile are not UTC then use the timezone option on the date filter to tell logstash what timezone they are in.

---

<div class="post-metadata">

**Author:** ![rahulnama](https://avatars.discourse-cdn.com/v4/letter/r/8c91f0/32.png) [@rahulnama](https://discuss.elastic.co/u/rahulnama)\
**Post date:** [July 16, 2020, 6:00pm UTC](https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506/3 "2020-07-16T18:00:26Z")

</div>

Got it. @Badger. Thank you

Also, In Kibana index patterns I'm seeing logdate type as string. Is that correct or it should be of type date as I'm applying date filter ?(please refer to above logstash.conf file)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/1/81fac7621b9fc861c0a6cf02c67ee997e8ca08fc.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 16, 2020, 6:05pm UTC](https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506/4 "2020-07-16T18:05:16Z")

</div>

The date filter does not modify the field it matches, it just modifies the target.

---

<div class="post-metadata">

**Author:** ![rahulnama](https://avatars.discourse-cdn.com/v4/letter/r/8c91f0/32.png) [@rahulnama](https://discuss.elastic.co/u/rahulnama)\
**Post date:** [July 16, 2020, 6:10pm UTC](https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506/5 "2020-07-16T18:10:38Z")

</div>

Cool.

Thank you @Badger 🙂

---

<div class="post-metadata">

**Author:** ![rahulnama](https://avatars.discourse-cdn.com/v4/letter/r/8c91f0/32.png) [@rahulnama](https://discuss.elastic.co/u/rahulnama)\
**Post date:** [July 16, 2020, 7:24pm UTC](https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506/6 "2020-07-16T19:24:08Z")

</div>

I just realized instead of changing the timezone in logstash.conf file, we can change the settings in kibana.

Go to Kibana -\> Stack Management -\> Advanced Settings -\> Timezone

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2020, 7:24pm UTC](https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506/7 "2020-08-13T19:24:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
