# Logstash date filter, unable to match with pattern defined in a field

**URL:** <https://discuss.elastic.co/t/logstash-date-filter-unable-to-match-with-pattern-defined-in-a-field/123893>\
**Category:** Logstash\
**Created:** [March 14, 2018, 11:44am UTC](https://discuss.elastic.co/t/logstash-date-filter-unable-to-match-with-pattern-defined-in-a-field/123893 "2018-03-14T11:44:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![janl](https://avatars.discourse-cdn.com/v4/letter/j/7cd45c/32.png) [@janl](https://discuss.elastic.co/u/janl)\
**Post date:** [March 14, 2018, 11:44am UTC](https://discuss.elastic.co/t/logstash-date-filter-unable-to-match-with-pattern-defined-in-a-field/123893/1 "2018-03-14T11:44:35Z")

</div>

Version 6.1.2  
I'm attempting to parse timestamps from various logsources using the date filter.  
Due to it being multiple logsources with very similar timestamp formats(think 2018/03/14 vs 2018/14/03)  
I wanted to define a field for specific logsources that included the expected timestamp format.

excerpt from the filters where the field is set, here for Cisco asa timestamp format

```
mutate {
  add_field => {"[@metadata][timeFormat]" => "MMM dd HH:mm:ss"}
  replace => {"[@metadata][timeZone]" => "America/Chicago"}
}

```

and later on, the date filter where i thought i could use the field [@metadata][timeFormat] set earlier.

```
date {
  locale => "en"
  timezone => "%{[@metadata][timeZone]}"
  match => ["timestamp", "%{[@metadata][timeFormat]}" ]
  target => "timestamp"
}

```

this fails with  
:exception=\>"Java::JavaLang::IllegalArgumentException  
:message=\>"Illegal pattern component: t"  
after searching around for it i guess this means that it attempted to use the string "%{[@metadata][timeFormat]}" as the format and at the first t in metadata it failed.

If i use  
match =\> ["timestamp", "MMM dd HH:mm:ss"]  
It works fine and logstash does not complain.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 11, 2018, 11:44am UTC](https://discuss.elastic.co/t/logstash-date-filter-unable-to-match-with-pattern-defined-in-a-field/123893/2 "2018-04-11T11:44:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.