# Logstash - filter the logevents based on time.send only specified date logs to the output plugin
**URL:** https://discuss.elastic.co/t/logstash-filter-the-logevents-based-on-time-send-only-specified-date-logs-to-the-output-plugin/95675
**Category:** Logstash
**Created:** [August 3, 2017, 9:14am UTC](https://discuss.elastic.co/t/logstash-filter-the-logevents-based-on-time-send-only-specified-date-logs-to-the-output-plugin/95675 "2017-08-03T09:14:33Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@soumya1](https://discuss.elastic.co/u/soumya1)
#### Post date: [August 3, 2017, 9:14am UTC](https://discuss.elastic.co/t/logstash-filter-the-logevents-based-on-time-send-only-specified-date-logs-to-the-output-plugin/95675/1 "2017-08-03T09:14:33Z")
hi
my need is that i have to send logs from date x to date y from a log file containing logs of many days.
i am using the log timestamp to compare with the time.now and then cancel the events matching a criteria,.
but the event.cancel is not working neither the timestamp comparision.Below config, i am comparing if the log is 5 days old
pls help
below is my config
input {
stdin {
codec =\> multiline {
pattern =\> "^\s"
what =\> "previous"
}
}
}
filter {
grok {
match =\> {"message" =\> "[%{YEAR:LogYear}-%{MONTHNUM:LogMonth}-%{MONTHDAY:LogDay} %{TIME:LogTime}] %{WORD:debuglevel} %{GREEDYDATA:logMessage}"}
}
mutate {
add\_field =\> { "mytimestamp" =\> "%{LogYear}-%{LogMonth}-%{LogDay} %{LogTime}"}
}
date {
match =\> ["mytimestamp", "ISO8601"]
target =\> "@timestamp"
timezone =\> "Asia/Kolkata"
}
ruby {
init =\> "require 'time'"
code =\> "event.cancel if "(Time.now.to\_f - @timestamp.to\_f)" ) \> (60 \* 60 \* 24 \* 5)"
}
}
output{
stdout { codec =\> rubydebug }
}
---
### Author:  [@soumya1](https://discuss.elastic.co/u/soumya1)
#### Post date: [August 3, 2017, 9:16am UTC](https://discuss.elastic.co/t/logstash-filter-the-logevents-based-on-time-send-only-specified-date-logs-to-the-output-plugin/95675/2 "2017-08-03T09:16:47Z")
sample output after processing is this
"debuglevel" =\> "INFO",
"@timestamp" =\> 2017-08-01T13:46:40.469Z,
"LogDay" =\> "1",
"mytimestamp" =\> "2017-08-1 19:16:40,469",
"LogTime" =\> "19:16:40,469",
"logMessage" =\> "[ThrottledRequestReaper-Produce], Starting (kafka.server.ClientQuotaManager$ThrottledRequestReaper)",
"@version" =\> "1",
"host" =\> "navya",
"LogYear" =\> "2017",
"message" =\> "[2017-08-1 19:16:40,469] INFO [ThrottledRequestReaper-Produce], Starting (kafka.server.ClientQuotaManager$ThrottledRequestReaper)",
"LogMonth" =\> "08"
seems like the conversion from ISO to UTC is causing issues.
pls help
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 31, 2017, 9:17am UTC](https://discuss.elastic.co/t/logstash-filter-the-logevents-based-on-time-send-only-specified-date-logs-to-the-output-plugin/95675/3 "2017-08-31T09:17:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.