# Logstash Date Filter Not Working with tab

**URL:** <https://discuss.elastic.co/t/logstash-date-filter-not-working-with-tab/228300>\
**Category:** Logstash\
**Created:** [April 16, 2020, 10:50am UTC](https://discuss.elastic.co/t/logstash-date-filter-not-working-with-tab/228300 "2020-04-16T10:50:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\
**Post date:** [April 16, 2020, 10:50am UTC](https://discuss.elastic.co/t/logstash-date-filter-not-working-with-tab/228300/1 "2020-04-16T10:50:36Z")

</div>

I need to parse event and time separated by tab using the date filter in logstash, but logstash failed to identify tab and gives an error

```auto
 grok{
      patterns_dir => ["./patterns"]
      match => { "message" => "%{TIMEFORMAT:eventtime}\t%{WORD:typedata}\t%{WORD:loglevel}\t%{TIME}\t%{HOSTNAME:hostmachine}\t%{GREEDYDATA:serviceinfo}\t%{SERVMSG}" }
    }

    date{
      match=>["eventtime","yyyy-MM-dd\tHH:mm:ss"]
    }
  }

```

```auto
TIMEFORMAT %{YEAR}-%{MONTHNUM}-%{MONTHDAY}\t%{TIME}
COMP %{WORD:componenttype}\t%{GREEDYDATA:logmessage}
SERVMSG %{COMP}|\t%{GREEDYDATA:logmessage}
SERVICEDATA %{WORD:environment}\\%{GREEDYDATA:machine}\|%{POSINT:PID}\|%{GREEDYDATA:service}

```

```auto
"Unable to configure plugins: Illegal pattern component: t"

```

So, How can I create the mapping for eventtime to date in logstash?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 16, 2020, 1:45pm UTC](https://discuss.elastic.co/t/logstash-date-filter-not-working-with-tab/228300/2 "2020-04-16T13:45:01Z")

</div>

> [@Atul\_Gunjal](#):
>
> How can I create the mapping for eventtime to date in logstash?

Use a literal tab in the configuration file.

---

<div class="post-metadata">

**Author:** ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\
**Post date:** [April 17, 2020, 4:41am UTC](https://discuss.elastic.co/t/logstash-date-filter-not-working-with-tab/228300/3 "2020-04-17T04:41:37Z")

</div>

```auto
date{
      match=>["eventtime","yyyy-MM-dd'\t'HH:mm:ss"]
      target=>["eventtime"]
    }

```

I tried this but it didn't work but error is now gone but eventtime is still string type and not date.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 17, 2020, 2:52pm UTC](https://discuss.elastic.co/t/logstash-date-filter-not-working-with-tab/228300/4 "2020-04-17T14:52:54Z")

</div>

If you already indexed documents in elasticsearch where eventtime is a string then all subsequent documents will have it as a string until you roll over to a new index.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2020, 2:52pm UTC](https://discuss.elastic.co/t/logstash-date-filter-not-working-with-tab/228300/5 "2020-05-15T14:52:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.