# Method for excluding event that cannot be used as Time Filter

**URL:** <https://discuss.elastic.co/t/method-for-excluding-event-that-cannot-be-used-as-time-filter/115635>\
**Category:** Logstash\
**Created:** [January 16, 2018, 5:50am UTC](https://discuss.elastic.co/t/method-for-excluding-event-that-cannot-be-used-as-time-filter/115635 "2018-01-16T05:50:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![j\_ram](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@j\_ram](https://discuss.elastic.co/u/j_ram)\
**Post date:** [January 16, 2018, 5:50am UTC](https://discuss.elastic.co/t/method-for-excluding-event-that-cannot-be-used-as-time-filter/115635/1 "2018-01-16T05:50:35Z")

</div>

I am currently running a script across my network that parses windows event logs.  
It stores the "SystemTime" in a csv for me. The time should look something like the following: "2017-12-21T04:59:51.667607100Z". I am currently using the "SystemTime" as the Time Filter Field.

I am parsing the CSVs using the CSV filter in logstash 6.1.1.

It has been working correctly in controlled environments and creating index patterns were working as intended. Once I started using larger data sets, I ran into an issue where the SystemTime column was not being saved correctly in the CSV. I cannot look for errors in logstash because logstash is simply saving SystemTime as a string.

My question is, is there a way to drop, or tag, these lines being read, if the SystemTime is not one of the approved Time Filters? I have not found an updated Time Filter standard since 2015, at the time they were:  
Joda-Time tokens plus the Logstash-specific ISO8601, UNIX, UNIX\_MS, and TAI64N tokens --- SOURCE : (user) magnusbareck (post) [Date filter recognizing custom grok pattern?](https://discuss.elastic.co/t/date-filter-recognizing-custom-grok-pattern/24363/2)

---

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [January 16, 2018, 6:12am UTC](https://discuss.elastic.co/t/method-for-excluding-event-that-cannot-be-used-as-time-filter/115635/2 "2018-01-16T06:12:27Z")

</div>

You should use if/else sintax.  
If no condition is met skip it with `drop` filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2018, 6:12am UTC](https://discuss.elastic.co/t/method-for-excluding-event-that-cannot-be-used-as-time-filter/115635/3 "2018-02-13T06:12:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.