# Logstash : Time Field

**URL:** <https://discuss.elastic.co/t/logstash-time-field/114453>\
**Category:** Logstash\
**Created:** [January 8, 2018, 7:00am UTC](https://discuss.elastic.co/t/logstash-time-field/114453 "2018-01-08T07:00:32Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rahul\_Pm](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@Rahul\_Pm](https://discuss.elastic.co/u/Rahul_Pm)\
**Post date:** [January 8, 2018, 7:00am UTC](https://discuss.elastic.co/t/logstash-time-field/114453/1 "2018-01-08T07:00:32Z")

</div>

Hi ,

I'm trying to parse a CSV file on my local machine via logstash and visualize it on Kibana. But the date field ("timestamp") is being parsed as a string, and not as a date type.

## This is how my config looks :

input {  
file {  
path =\> "C:\Users\310309705\Desktop\events-jan2.csv"  
start\_position =\> beginning

}  
}

filter {  
csv {  
columns =\> ["siteid", "state", "hostaddress", "hostname", "service", "timestamp"]  
}  
date {  
match =\> ["timestamp", "MM-dd-yyyy HH:mm:ss"]  
}  
}

output {  
stdout { }  
elasticsearch {  
hosts =\> "localhost"  
index =\> "events-jan2"  
}  
}

* * *

Please help.

Thank you,  
Rahul

---

<div class="post-metadata">

**Author:** ![Rahul\_Pm](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@Rahul\_Pm](https://discuss.elastic.co/u/Rahul_Pm)\
**Post date:** [January 8, 2018, 7:32am UTC](https://discuss.elastic.co/t/logstash-time-field/114453/2 "2018-01-08T07:32:47Z")

</div>

Its taking the time which logstash parsed the file, and not the actual time in the data itself.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 8, 2018, 7:34am UTC](https://discuss.elastic.co/t/logstash-time-field/114453/3 "2018-01-08T07:34:19Z")

</div>

What does an event look like?

---

<div class="post-metadata">

**Author:** ![Rahul\_Pm](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@Rahul\_Pm](https://discuss.elastic.co/u/Rahul_Pm)\
**Post date:** [January 8, 2018, 8:33am UTC](https://discuss.elastic.co/t/logstash-time-field/114453/4 "2018-01-08T08:33:25Z")

</div>

| siteid | state | hostaddress | hostname | service | timestamp |
| --- | --- | --- | --- | --- | --- |
| IDM02 | CRITICAL | 192.16.9.22 | 19.22 | VirtualizationStatus | 12/11/2017 2:40 |

---

<div class="post-metadata">

**Author:** ![Rahul\_Pm](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@Rahul\_Pm](https://discuss.elastic.co/u/Rahul_Pm)\
**Post date:** [January 8, 2018, 8:35am UTC](https://discuss.elastic.co/t/logstash-time-field/114453/5 "2018-01-08T08:35:08Z")

</div>

Should I retry renaming the "timestamp" field to something else? (Just a thought)

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 8, 2018, 8:43am UTC](https://discuss.elastic.co/t/logstash-time-field/114453/6 "2018-01-08T08:43:59Z")

</div>

The timestamp you provided for the date filter does not match the format in the event, which is why it fails. You need to update the pattern to match what you actually have got in the event, e.g. `dd/MM/yyyy h:mm` (if that is the correct order for day and month).

---

<div class="post-metadata">

**Author:** ![Rahul\_Pm](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@Rahul\_Pm](https://discuss.elastic.co/u/Rahul_Pm)\
**Post date:** [January 8, 2018, 8:47am UTC](https://discuss.elastic.co/t/logstash-time-field/114453/7 "2018-01-08T08:47:32Z")

</div>

The data is in MM/dd/yyyy format.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 8, 2018, 8:56am UTC](https://discuss.elastic.co/t/logstash-time-field/114453/8 "2018-01-08T08:56:45Z")

</div>

Then adjust the pattern accordingly.

---

<div class="post-metadata">

**Author:** ![Rahul\_Pm](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@Rahul\_Pm](https://discuss.elastic.co/u/Rahul_Pm)\
**Post date:** [January 8, 2018, 9:38am UTC](https://discuss.elastic.co/t/logstash-time-field/114453/9 "2018-01-08T09:38:37Z")

</div>

That's how I have adjusted the pattern. But still no luck.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 8, 2018, 9:52am UTC](https://discuss.elastic.co/t/logstash-time-field/114453/10 "2018-01-08T09:52:17Z")

</div>

This test of the date format parsing seems to work for me:

```auto
input {
  generator {
    lines => ['12/11/2017 2:40']
    count => 1
  } 
} 

filter {
    date {
        match => ["message", "MM/dd/yyyy h:mm"]
    }
}

output {
  stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2018, 9:52am UTC](https://discuss.elastic.co/t/logstash-time-field/114453/11 "2018-02-05T09:52:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.