# Logstash date filter won't parse my date field

**URL:** https://discuss.elastic.co/t/logstash-date-filter-wont-parse-my-date-field/91146
**Category:** Logstash
**Created:** [June 28, 2017, 4:02pm UTC](https://discuss.elastic.co/t/logstash-date-filter-wont-parse-my-date-field/91146 "2017-06-28T16:02:09Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![Tomer\_Lev](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@Tomer\_Lev](https://discuss.elastic.co/u/Tomer_Lev)
#### Post date: [June 28, 2017, 4:02pm UTC](https://discuss.elastic.co/t/logstash-date-filter-wont-parse-my-date-field/91146/1 "2017-06-28T16:02:09Z")

</div>

Hi 😄

## TL;DR

## logstash won't parse date field; date field parsed as string...

I'm trying to parse my date field using logstash date filter

> **[Date filter plugin | Logstash Plugins](https://www.elastic.co/docs/reference/logstash/plugins/plugins-filters-date)**
>
> Plugin version: v3.1.15 (Other versions), Released on: 2022-06-29, Changelog. For questions about the plugin, open a topic in the Discuss forums. For...

but with no success...  
looks like it is not override the @timestamp field and also when using other target field it is written as a string field and not a date field.

my input + filter looks like this:

> input {  
> beats {  
> port =\> 5044  
> codec =\> "json"  
> }  
> }  
> filter {
> 
> date {  
> match =\> ["time" , "ISO8601"]  
> #target =\> "parsed\_date" # when using this the "parsed\_date" field creates as type of string  
> }  
> }

and my log line (fired by filebeat) looks something like this:  
{ "time":"2017-06-20T16:22:24.4233978Z","id":"025c4c1c65","type":"Error","message":"some message" }

when looking in logstash logs there is no errors at all relating to this plugin.  
also there is nothing in the tag of the indexed document telling there was a parsing error or something like that.  
am I missing something ?

thanks in advance for any help 🙂

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 28, 2017, 5:36pm UTC](https://discuss.elastic.co/t/logstash-date-filter-wont-parse-my-date-field/91146/2 "2017-06-28T17:36:42Z")

</div>

Please show what you get in ES for the sample log line above. Copy/paste from the JSON tab of Kibana's Discover view.

> when using other target field it is written as a string field and not a date field.

That's expected. It's mostly ES that determines the type of fields.

---

<div class="post-metadata">

### Author: ![Tomer\_Lev](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@Tomer\_Lev](https://discuss.elastic.co/u/Tomer_Lev)
#### Post date: [June 29, 2017, 7:56am UTC](https://discuss.elastic.co/t/logstash-date-filter-wont-parse-my-date-field/91146/3 "2017-06-29T07:56:17Z")

</div>

Hi, here is the a document json:

```
  {
      "_index": "filebeat-***",
      "_type": "log",
      "_id": "AVzyzoBDxsbYSTAmagCY",
      "_version": 1,
      "_score": null,
      "_source": {
        "exception": {
          "stack": " ****",
          "source": {
            "code": {
              "file": " *****",
              "line": 12,
              "column": 17
            },
            "method": "IfNull",
            "assembly": "LogAndThrow",
            "type": "***"
          },
          "type": "ServiceException",
          "message": "***"
        },
        "data": {
          "source_version": "4.11.0.0",
          "source_name": " ****"
        },
        "offset": 815808416,
        "input_type": "log",
        "source": "Service.log",
        "type": "log",
        "message": "Uncaught exception",
        "tags": [
          "beats_input_codec_json_applied"
        ],
        "@timestamp": "2017-06-29T07:43:46.025Z",
        "@version": "1",
        "beat": {
          "hostname": " *****",
          "name": " *****",
          "version": "5.3.0"
        },
        "host": " ****",
        "time": "2017-06-29T07:43:44.5908205Z",
        "id": "93136d271e"
      },
      "fields": {
        "@timestamp": [
          1498722226025
        ]
      },
      "sort": [
        1498722226025
      ]
    }

```

thanks for replying 🙂

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 29, 2017, 8:38am UTC](https://discuss.elastic.co/t/logstash-date-filter-wont-parse-my-date-field/91146/4 "2017-06-29T08:38:16Z")

</div>

Hmm, this looks correct. I don't know what's going on.

---

<div class="post-metadata">

### Author: ![Tomer\_Lev](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@Tomer\_Lev](https://discuss.elastic.co/u/Tomer_Lev)
#### Post date: [June 29, 2017, 8:42am UTC](https://discuss.elastic.co/t/logstash-date-filter-wont-parse-my-date-field/91146/5 "2017-06-29T08:42:37Z")

</div>

![](https://us1.discourse-cdn.com/elastic/original/3X/7/8/782fd29c344e5f6449709ee82e311ed3063a1434.png)

why the time field in middle does not match the left column and right column ?

---

<div class="post-metadata">

### Author: ![Tomer\_Lev](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@Tomer\_Lev](https://discuss.elastic.co/u/Tomer_Lev)
#### Post date: [June 29, 2017, 9:02am UTC](https://discuss.elastic.co/t/logstash-date-filter-wont-parse-my-date-field/91146/6 "2017-06-29T09:02:11Z")

</div>

OK I think I get it, Kibana adjust the timezone to the browser timezone does it ?

there is a way to change that ?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 29, 2017, 9:04am UTC](https://discuss.elastic.co/t/logstash-date-filter-wont-parse-my-date-field/91146/7 "2017-06-29T09:04:10Z")

</div>

> OK I think I get it, Kibana adjust the timezone to the browser timezone does it ?

Yes.

> there is a way to change that ?

Yes, there's a Kibana setting for that .

---

<div class="post-metadata">

### Author: ![Tomer\_Lev](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@Tomer\_Lev](https://discuss.elastic.co/u/Tomer_Lev)
#### Post date: [June 29, 2017, 9:06am UTC](https://discuss.elastic.co/t/logstash-date-filter-wont-parse-my-date-field/91146/8 "2017-06-29T09:06:13Z")

</div>

Thanks it works

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 27, 2017, 9:06am UTC](https://discuss.elastic.co/t/logstash-date-filter-wont-parse-my-date-field/91146/9 "2017-07-27T09:06:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
