# Modify All Logs Before Giving To Filter
**URL:** https://discuss.elastic.co/t/modify-all-logs-before-giving-to-filter/257815
**Category:** Logstash
**Created:** [December 7, 2020, 8:16am UTC](https://discuss.elastic.co/t/modify-all-logs-before-giving-to-filter/257815 "2020-12-07T08:16:22Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@rknd](https://discuss.elastic.co/u/rknd)
#### Post date: [December 7, 2020, 8:16am UTC](https://discuss.elastic.co/t/modify-all-logs-before-giving-to-filter/257815/1 "2020-12-07T08:16:22Z")
Hello everyone,
Imagine that I have a codec plugin for input and my logs like this :
00:23 Lorem Ipsum
13:35 Lorem Ipsum
14:00 DATE-LINE 01/01/2020
15:43 Lorem Ipsum
20:20 Lorem Ipsum
00:15 Lorem Ipsum
13:10 DATE-LINE 02/01/2020
14:50 Lorem Ipsum
....
I want to make ruby a codec plugin that calculate dates via DATE-LINE before sending to filter plugin. I mean the output like;
00:23 (01/01/2020) Lorem Ipsum
13:35 (01/01/2020) Lorem Ipsum
14:00 DATE-LINE 01/01/2020
15:43 (01/01/2020) Lorem Ipsum
20:20 (01/01/2020) Lorem Ipsum
00:15 (02/01/2020) Lorem Ipsum
13:10 DATE-LINE 02/01/2020
14:50 (02/01/2020) Lorem Ipsum
How can i do this with a ruby codec plugin ? Can someone give an example code ?
Thanks for helping
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 7, 2020, 7:50pm UTC](https://discuss.elastic.co/t/modify-all-logs-before-giving-to-filter/257815/2 "2020-12-07T19:50:48Z")
There are a couple of ideas [here](https://discuss.elastic.co/t/give-events-without-timestamp-the-timestamp-from-the-last-event/131149/2).
You will need event order preserved so you must set pipeline.workers 1 and, if needed, pipeline.ordered (in 7.10 the default will be OK).
No way do the first two lines get the date from the third line added. I do not think it is possible.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 4, 2021, 7:51pm UTC](https://discuss.elastic.co/t/modify-all-logs-before-giving-to-filter/257815/3 "2021-01-04T19:51:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.