# Logstash date filter **URL:** \ **Category:** Logstash\ **Created:** [August 9, 2023, 7:21am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427 "2023-08-09T07:21:56Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Post date:** [August 9, 2023, 7:21am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427/1 "2023-08-09T07:21:56Z")
Hi i have a short\_date field in the following format ```auto 09/Aug/2023:12:44:15 +0530 ``` This field is created as text. To convert it to date i am doing the following ```auto date { match => ["short_date", "dd/MMM/yyyy:HH:mm:ss Z"] target=> "short_date" } ``` The field is getting saved as date but the time value is coming different for the date 09/Aug/2023:12:44:15 +0530 the value is coming as 2023-08-09T07:14:15.000Z Timing is different. Where is the mistake\> ---
**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Post date:** [August 9, 2023, 7:40am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427/2 "2023-08-09T07:40:49Z")
Hello Neelam, There is no error: I guess your local time is India Standard Time as the date shows `+0530` and Elastic stores the dates always in the Zulu Time (`Z`). So your date was parsed correctly and then translated into the standard timezone. In Kibana, you can configure the timezone that should be shown under advanced settings `dateFormat:tz` so you can view the date as you expect. Best regards Wolfram ---
**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Post date:** [August 9, 2023, 7:42am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427/3 "2023-08-09T07:42:06Z")
Thanks for the quick response. but the default @timestamp field in every document comes in correct time ---
**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Post date:** [August 9, 2023, 7:46am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427/4 "2023-08-09T07:46:26Z")
The default `@timestamp` relies on the systems date settings I think so it can be system specific. Are you running on Windows or Linux? Is the systems timezone configured correctly? ---
**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Post date:** [August 9, 2023, 7:51am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427/5 "2023-08-09T07:51:11Z")
it's on linux. ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0d1c1e25e3d14c350e06f18f9ce410fb9747f4b1.png) This is the kibana setting What do i need to change to have same date value in short\_date? can i specify the timezone in the date filter? ---
**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Post date:** [August 9, 2023, 7:54am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427/6 "2023-08-09T07:54:09Z")
Yes, you can configure the date filter with a [timezone](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-timezone) but I don't know if this is used when the date already has a timezone given. ---
**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Post date:** [August 9, 2023, 8:13am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427/7 "2023-08-09T08:13:16Z")
one observation. I have the same setup on a windows machine too. But on that machine the date format is slightly different it has mili seconds too ```auto 09/Aug/2023:13:39:31.066 +0530 ``` so after i apply the date filter ```auto date { match => ["short_date", "dd/MMM/yyyy:HH:mm:ss Z"] target=> "short_date" } ``` since the :SSS is missing short\_Date is still in text format but the value of time is correct 09/Aug/2023:13:39:31.066 +0530 Is it not getting converted at all? ---
**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Post date:** [August 9, 2023, 8:21am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427/8 "2023-08-09T08:21:22Z")
I guess this is true - when a date expression did not match this does not cause an error. You should be able to check this easily: By default, the date filter adds a tag when the parsing fails: [Date filter plugin | Logstash Reference [8.9] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-tag_on_failure) So you can check if this document has a `_dateparsefailure` tag (if you didn't remove the tags) ---
**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Post date:** [August 9, 2023, 8:22am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427/9 "2023-08-09T08:22:47Z")
yes it had, when i added a .SSS to the date filter match pattern it again works the same way as it was in linux m/c. the time changes. I'm still not clear as to what has to be changed? ---
**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Post date:** [August 9, 2023, 8:28am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427/10 "2023-08-09T08:28:27Z")
If anything, you should change Kibana timezone to show the date correctly. The ingest works correctly as it aligns incoming dates to a common timezone (Zulu) so that you can compare dates in docs from different countries(e.g. India and US). ---
**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Post date:** [August 9, 2023, 8:29am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427/11 "2023-08-09T08:29:42Z")
Hi, got it working. i added timezone=\> "Universal" in the date filter. and now the time is matching. Thank you for the quick support!! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 6, 2023, 8:30am UTC](https://discuss.elastic.co/t/logstash-date-filter/340427/12 "2023-09-06T08:30:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.