# Logstash date parse failure - ruby exception

**URL:** https://discuss.elastic.co/t/logstash-date-parse-failure-ruby-exception/333710
**Category:** Logstash
**Created:** [May 18, 2023, 4:08am UTC](https://discuss.elastic.co/t/logstash-date-parse-failure-ruby-exception/333710 "2023-05-18T04:08:57Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![sai\_ravi\_shankar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_ravi_shankar/32/120767_2.png) [@sai\_ravi\_shankar](https://discuss.elastic.co/u/sai_ravi_shankar)
#### Post date: [May 18, 2023, 4:08am UTC](https://discuss.elastic.co/t/logstash-date-parse-failure-ruby-exception/333710/1 "2023-05-18T04:08:57Z")

</div>

Hi,

I am trying to use timestamp for each document by the value present in file name but i am getting Ruby exception occurred: wrong argument type DateTime (expected LogStash::Timestamp)

when i run ruby code. it is working fine but logstash throwing an exception.

data in csv file:  
column1|column2  
abcd|25  
abcd|26  
abcd|27  
abcd|28

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0a38f6e0460e998ee4eedb16888c76e0e28e8470.png)

input {  
file {  
path =\> ["D:/test/test\_2324\_20220312111008.csv"]  
start\_position =\> "beginning"  
}  
}  
filter {  
csv {  
separator =\> "|"  
skip\_header =\> true  
columns =\> ["column1","column2"]  
}  
ruby {

```
        code => '
        require "date"                        
        time_end=event.get("path").to_s
        arr1=time_end.split("_")
        tend=arr1[1]
        arr2=arr1[2].split(".")
        event_time=arr2[0]
        event.set("tracking_header",tend)
        event.set("event_time",event_time)
        
        event_created = event_time[6,2]+"-"+event_time[4,2]+"-"+event_time[0,4]+" "+event_time[8,2]+":"+event_time[10,2]+":"+event_time[12,2]
        event.set("reported_time",event_created)                  
        
        zz = DateTime.new(event_time[0,4].to_i,event_time[4,2].to_i,event_time[6,2].to_i,event_time[8,2].to_i,event_time[10,2].to_i,event_time[12,2].to_i)
        event.set("@timestamp",zz)

        '
    }
}

```

output {  
stdout {  
codec =\> rubydebug  
}  
}

exception:

Ruby exception occurred: wrong argument type DateTime (expected LogStash::Timestamp)

Could someone please help on this.

Thanks in advance.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 18, 2023, 4:18am UTC](https://discuss.elastic.co/t/logstash-date-parse-failure-ruby-exception/333710/2 "2023-05-18T04:18:36Z")

</div>

> [@sai\_ravi\_shankar](#):
>
> ```auto
> zz = DateTime.new(event_time[0,4].to_i,event_time[4,2].to_i,event_time[6,2].to_i,event_time[8,2].to_i,event_time[10,2].to_i,event_time[12,2].to_i)
> event.set("@timestamp",zz)
> 
> ```

If you want to event.set [@timestamp] then feed it a Time object, not a DateTime object. [Here](https://discuss.elastic.co/t/how-to-replace-timestamp-field-in-logstash-aggregate-filter-map/275708/2), for example. I believe the constructor will do the work for you in that case.

---

<div class="post-metadata">

### Author: ![sai\_ravi\_shankar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_ravi_shankar/32/120767_2.png) [@sai\_ravi\_shankar](https://discuss.elastic.co/u/sai_ravi_shankar)
#### Post date: [May 18, 2023, 6:11am UTC](https://discuss.elastic.co/t/logstash-date-parse-failure-ruby-exception/333710/3 "2023-05-18T06:11:49Z")

</div>

Thanks @Badger . it's working now.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 15, 2023, 6:12am UTC](https://discuss.elastic.co/t/logstash-date-parse-failure-ruby-exception/333710/4 "2023-06-15T06:12:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.