# Logstash pull date out of json event

**URL:** <https://discuss.elastic.co/t/logstash-pull-date-out-of-json-event/71010>\
**Category:** Logstash\
**Created:** [January 10, 2017, 1:53am UTC](https://discuss.elastic.co/t/logstash-pull-date-out-of-json-event/71010 "2017-01-10T01:53:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_Clifton](https://avatars.discourse-cdn.com/v4/letter/c/82dd89/32.png) [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\
**Post date:** [January 10, 2017, 1:53am UTC](https://discuss.elastic.co/t/logstash-pull-date-out-of-json-event/71010/1 "2017-01-10T01:53:58Z")

</div>

Wondering what's best way to pull date and timezone of a structured json event that comes into logstash,

event looks like :

{  
"datetime" =\> {  
"date" =\> "2017-01-10 00:05:25.768826",  
"timezone" =\> "UTC",  
"timezone\_type" =\> 3  
},  
"level\_name" =\> "ERROR",  
"@timestamp" =\> 2017-01-10T01:20:55.811Z,  
"level" =\> 400,  
"extra" =\> [],  
"context" =\> {  
"exception" =\> {  
"code" =\> 0,  
"file" =\> "/var/www/app2/cache/prod/classes.php:4595",  
"previous" =\> {  
"code" =\> 0,  
"file" =\> "/var/www/app2/cache/prod/thisProdMatcher.php:75",  
"message" =\> "",  
"class" =\> "Symfony\Component\Routing\Exception\ResourceNotFoundException"  
},  
"message" =\> "No route found for "GET /test"",  
"class" =\> "Symfony\Component\HttpKernel\Exception\NotFoundHttpException"  
}  
},  
"channel" =\> "request",  
"@version" =\> "1",  
"host" =\> "localhost",  
"message" =\> "Uncaught PHP Exception Symfony\Component\HttpKernel\Exception\NotFoundHttpException: "No route found for "GET /test"" at /var/www/app2/cache/prod/classes.php line 4595",  
"tags" =\> []  
}

I thought date filter could match, but not sure syntax to match it.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 10, 2017, 7:10am UTC](https://discuss.elastic.co/t/logstash-pull-date-out-of-json-event/71010/2 "2017-01-10T07:10:22Z")

</div>

```nohighlight
date {
  match => ["[datetime][date]", "ISO8601"]
  timezone => "%{[datetime][timezone]}"
}

```

[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references)

---

<div class="post-metadata">

**Author:** ![Chris\_Clifton](https://avatars.discourse-cdn.com/v4/letter/c/82dd89/32.png) [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\
**Post date:** [January 10, 2017, 9:08pm UTC](https://discuss.elastic.co/t/logstash-pull-date-out-of-json-event/71010/3 "2017-01-10T21:08:15Z")

</div>

That worked, thanks! Had to trim my date field down, date doesn't support 6 digit second precision.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 7, 2017, 9:08pm UTC](https://discuss.elastic.co/t/logstash-pull-date-out-of-json-event/71010/4 "2017-02-07T21:08:17Z")

</div>

Closed on February 7, 2017, 9:08pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.