# Logstash date filter not working

**URL:** https://discuss.elastic.co/t/logstash-date-filter-not-working/169381
**Category:** Logstash
**Created:** [February 21, 2019, 10:24am UTC](https://discuss.elastic.co/t/logstash-date-filter-not-working/169381 "2019-02-21T10:24:18Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![vasudevan](https://avatars.discourse-cdn.com/v4/letter/v/f07891/32.png) [@vasudevan](https://discuss.elastic.co/u/vasudevan)
#### Post date: [February 21, 2019, 10:24am UTC](https://discuss.elastic.co/t/logstash-date-filter-not-working/169381/1 "2019-02-21T10:24:18Z")

</div>

We have log file in which we have to capture the first line matching "TIMESTAMP\_ISO8601" against build\_StartTime filed and last line matching "TIMESTAMP\_ISO8601" against build\_EndTime filed. After this we have to calculate the difference and should store the difference against duration filed. We tried with date filter but that's not working out, Please help us  
**Log File:**  
[2019-01-31 21:28:22Z INFO Program] Version: 2.122.1  
some logs in the middle  
[2019-01-31 21:28:45Z INFO Worker] Job completed.

**Below is our current Logstash config File:**  
input {  
beats {  
client\_inactivity\_timeout =\> 1200  
port =\> 5002  
}  
}

filter  
{  
grok {  
add\_tag =\> ["start"]  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:build\_StartTime}" }  
}  
date {  
match =\> ["build\_StartTime", "ISO8601"]  
target =\> "build\_StartTime"  
}  
mutate {  
remove\_field =\> ["message"]  
}  
}

output {  
elasticsearch {  
hosts =\> ["elasticsearch:9200"]  
index =\> "tfslog-%{+YYYY.MM.dd}"  
}  
stdout { codec =\> rubydebug }  
}  
**LOGSTASH OUTPUT:**  
"\_index": "tfslog-2019.02.21",  
"\_type": "doc",  
"\_id": "-dKUD2kBAWdIEry4JFmb",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"tags": [  
"beats\_input\_codec\_plain\_applied",  
"start",  
"\_dateparsefailure"  
],  
"beat": {  
"hostname": "RMD-VRA103029",  
"version": "6.3.0",  
"name": "RMD-VRA103029"  
},  
"@version": "1",  
"offset": 19709,  
"@timestamp": "2019-02-21T10:21:39.153Z",  
"source": "C:\TFS2017\_Agent\_diag\Worker\_20190134-00015-utc.log",  
"host": {  
"name": "RMD-VRA103029"  
},  
"build\_StartTime": "2019-01-31 21:28:22Z"  
},  
"fields": {  
"@timestamp": [  
"2019-02-21T10:21:39.153Z"  
]  
},  
"sort": [  
1550744499153  
]

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 21, 2019, 10:32am UTC](https://discuss.elastic.co/t/logstash-date-filter-not-working/169381/2 "2019-03-21T10:32:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.