# Logstash Time Column Issue

**URL:** <https://discuss.elastic.co/t/logstash-time-column-issue/366693>\
**Category:** Elasticsearch\
**Created:** [September 17, 2024, 5:53pm UTC](https://discuss.elastic.co/t/logstash-time-column-issue/366693 "2024-09-17T17:53:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\
**Post date:** [September 17, 2024, 5:53pm UTC](https://discuss.elastic.co/t/logstash-time-column-issue/366693/1 "2024-09-17T17:53:14Z")

</div>

I am trying to get logstash to ingest the time column correctly into elasticsearch but it is not working. I am stuck and need help.

in the csv I am trying to ingest the time looks like this:

```auto
2024-09-01 12:10:40.309

```

My Logstash Conf file looks like this in relation to the time column

```auto
    mutate {
		gsub => ["time", "IST", "Asia/Kolkata"]
		}
	date {
		match => ["time", "yyyy-mm-dd'T'hh:mm:ss'Z'"]
        target => "time"
		}

```

When I view the data in Elasticsearch the time column is showing up as text and not date. Can someone please help figure this out. I don't understand what is happening.

One time I was able to get it to ingest like this, however out of 52,000 documents it only ingested 900. I have 8 CSVs I need to ingest all with the same time format.

```auto
Sep 3, 2024 @ 06:05:55.000

```

Can I adjust the time column from text to date after it has been indexed?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 17, 2024, 8:26pm UTC](https://discuss.elastic.co/t/logstash-time-column-issue/366693/2 "2024-09-17T20:26:38Z")

</div>

Hello,

Please share the output you have in Elasticsearch, it is not clear how your document looks like and what is the Logstash output.

Also, you are using this `gsub`.

`gsub => ["time", "IST", "Asia/Kolkata"]`

This would replace the value `IST` for `Asia/Kolkata` in the field `time`, but the value you shared does not have `IST` in it.

> 2024-09-01 12:10:40.309

What are you trying to achieve with this filter?

Your date filter also does not match the time string you shared.

Please share a sample of your csv, not just one field, and your full logstash pipeline.

---

<div class="post-metadata">

**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\
**Post date:** [September 17, 2024, 10:01pm UTC](https://discuss.elastic.co/t/logstash-time-column-issue/366693/3 "2024-09-17T22:01:55Z")

</div>

Thanks for this. I realized by analyzing the CSV data set that the issues are with the data and not the ingest.