# Logstash is not converting a syslog date to date
**URL:** https://discuss.elastic.co/t/logstash-is-not-converting-a-syslog-date-to-date/107985
**Category:** Logstash
**Created:** [November 16, 2017, 4:46pm UTC](https://discuss.elastic.co/t/logstash-is-not-converting-a-syslog-date-to-date/107985 "2017-11-16T16:46:51Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@ajstark123](https://discuss.elastic.co/u/ajstark123)
#### Post date: [November 16, 2017, 4:46pm UTC](https://discuss.elastic.co/t/logstash-is-not-converting-a-syslog-date-to-date/107985/1 "2017-11-16T16:46:52Z")
We are using the following: %{SYSLOGTIMESTAMP:syslog\_time} to extract the syslog date from the logs. The format of this field is Nov 16 11:43:38 in the logs.
we are trying to convert syslogtime from a string to a date with the following date filter code. Logstash is unable to do the conversion.
date {
match =\> [ "syslog\_time",
"MMM d HH:mm:ss",
"MMM dd HH:mm:ss",
"MMM d HH:mm:ss",
"ISO8601" ]
}
How do we get syslogtime converted to a date field?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 16, 2017, 4:52pm UTC](https://discuss.elastic.co/t/logstash-is-not-converting-a-syslog-date-to-date/107985/2 "2017-11-16T16:52:21Z")
If the date filter fails it'll log a message that points you to what part of the string it finds objectionable.
---
### Author:  [@ajstark123](https://discuss.elastic.co/u/ajstark123)
#### Post date: [November 16, 2017, 4:56pm UTC](https://discuss.elastic.co/t/logstash-is-not-converting-a-syslog-date-to-date/107985/3 "2017-11-16T16:56:11Z")
I do not see an error in the log. But elastic is still treating it as a string. Do I need to turn on debugging.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 16, 2017, 4:59pm UTC](https://discuss.elastic.co/t/logstash-is-not-converting-a-syslog-date-to-date/107985/4 "2017-11-16T16:59:16Z")
Um, wait. If you want to convert `syslog_time` to a timestamp you need to use the date filter's `target` option. By default the result is stored in the `@timestamp` field. Since the `syslog_time` field already has been mapped as a string you need to recreate the index.
---
### Author:  [@ajstark123](https://discuss.elastic.co/u/ajstark123)
#### Post date: [November 16, 2017, 8:58pm UTC](https://discuss.elastic.co/t/logstash-is-not-converting-a-syslog-date-to-date/107985/5 "2017-11-16T20:58:56Z")
In retrospect the default behavior of placing the time in @timestamp is better use case. than me original id.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 14, 2017, 8:59pm UTC](https://discuss.elastic.co/t/logstash-is-not-converting-a-syslog-date-to-date/107985/6 "2017-12-14T20:59:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.