# Matching string field and changing it to date

**URL:** <https://discuss.elastic.co/t/matching-string-field-and-changing-it-to-date/122407>\
**Category:** Logstash\
**Created:** [March 4, 2018, 2:16pm UTC](https://discuss.elastic.co/t/matching-string-field-and-changing-it-to-date/122407 "2018-03-04T14:16:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\
**Post date:** [March 4, 2018, 2:16pm UTC](https://discuss.elastic.co/t/matching-string-field-and-changing-it-to-date/122407/1 "2018-03-04T14:16:49Z")

</div>

Hi everyone!  
I have the following JSON doc:

```
{
"DataChangeInfo" : "Archive Log Set archiveLogSet.25933761.25933688",
"documentsList" : [
{
  "commandScn": "25933758",
  "commandCommitScn": "0",
  "commandSequence": "3",
  "commandType": "INSERT",
  "commandTimestamp": "2017-12-07 05:09:54+03:000",
  "objectDBName": "DB4",
  "objectSchemaName": "CFTNA",
  "objectId": "NEWJOU",
  "changedFieldsList": [
    {
      "fieldId": "PK_NEWJOU",
      "fieldType": "NUMBER",
      "fieldValue": "NULL",
      "fieldChanged": "Y"
    },
    {
      "fieldId": "OFFICE",
      "fieldType": "CHAR",
      "fieldValue": "NULL",
      "fieldChanged": "Y"
    },
    {
      "fieldId": "UPDATE_DATE",
      "fieldType": "DATE",
      "fieldValue": "2017-12-07 05:09:54+03:000",
      "fieldChanged": "Y"
    },
    {
      "fieldId": "ENDDATE",
      "fieldType": "DATE",
      "fieldValue": "NULL",
      "fieldChanged": "Y"
}
]
}

```

Now, "commandTimestamp": "2017-12-07 05:09:54+03:000" is the relevant field that I want to be saved as a date, and currently it's being saved as a string.

How can I do this?  
It's not necessarily the field I want to be saved as @timestamp, but I want to aggregate by time in this field, and not as string.

I tried the following filter in logstash:

```
    date{
            match => ["[documentsList][commandTimeStamp]","yyyy-MM-dd HH:mm:ss","ISO8601","yyy-MM-dd HH:mm:ssZZZ","UNIX"]
            target => ["new_timestamp"]
    }

```

and I don't see any results or any new fields.  
What am I doing wrong?  
How can I do this?  
Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 4, 2018, 6:59pm UTC](https://discuss.elastic.co/t/matching-string-field-and-changing-it-to-date/122407/2 "2018-03-04T18:59:59Z")

</div>

The `documentsList` field is an array. You can use `[documentsList][0][commandTimeStamp]` to address its first element and the `commandTimeStamp` field within it.

You have a weird time format so I wouldn't be surprised if your date filter can't parse it. What's up with the final zero in the timezone offset? If it's always zero at the end you could set the pattern to expect a zero there; `yyyy-MM-dd HH:mm:ssZZ'0'` will probably work.

---

<div class="post-metadata">

**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\
**Post date:** [March 5, 2018, 7:37am UTC](https://discuss.elastic.co/t/matching-string-field-and-changing-it-to-date/122407/3 "2018-03-05T07:37:15Z")

</div>

Hi, thank you for the answer.  
I did as you suggested:

```
date{
                match => ["[documentsList][0][commandTimeStamp]","yyyy-MM-dd HH:mm:ssZZ'0'","ISO8601","yyy-MM-dd HH:mm:ssZZZ","UNIX"]
                target => ["new_timestamp"]
        }

```

but still, when I check the mapping for my index I see:

```
"commandTimestamp": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              }

```

And I see no new field "new\_timestamp" the way I defined in the "target" line in the filter.  
What am I doing wrong?  
BTW, there are no error messages in logstash error through the process.

---

<div class="post-metadata">

**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\
**Post date:** [March 5, 2018, 8:35am UTC](https://discuss.elastic.co/t/matching-string-field-and-changing-it-to-date/122407/4 "2018-03-05T08:35:59Z")

</div>

sorry, my bad. your solution solved it, there was a typo.  
Thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2018, 8:36am UTC](https://discuss.elastic.co/t/matching-string-field-and-changing-it-to-date/122407/5 "2018-04-02T08:36:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.