# Need help with date filter

**URL:** <https://discuss.elastic.co/t/need-help-with-date-filter/228968>\
**Category:** Logstash\
**Created:** [April 21, 2020, 6:00am UTC](https://discuss.elastic.co/t/need-help-with-date-filter/228968 "2020-04-21T06:00:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![back2base](https://avatars.discourse-cdn.com/v4/letter/b/c5a1d2/32.png) [@back2base](https://discuss.elastic.co/u/back2base)\
**Post date:** [April 21, 2020, 6:00am UTC](https://discuss.elastic.co/t/need-help-with-date-filter/228968/1 "2020-04-21T06:00:56Z")

</div>

Hello to everyone!  
I am new to ELK stack so I need help with date filter for rsyslog messages from Aix.  
I am sending logs from Aix to ELK and here is what I see in logstash stdout:

apr 21 08:45:01 myhost logstash[19429]: [2020-04-21T08:45:01,363][WARN][org.logstash.Event][main] Error parsing @timestamp string value=2020-04-21T08:45:01.104840+90:21

{  
"@timestamp" =\> 2020-04-21T08:45:01.363Z,  
"tags" =\> [  
[0] "_timestampparsefailure"  
],  
"_@timestamp" =\> "2020-04-21T08:45:01.104840+90:21",  
"type" =\> "rsyslog\_aix",  
"host" =\> "myhost",  
"syslog-tag" =\> "unix:",  
"@version" =\> "1",  
"message" =\> " The privilege command /usr/bin/vmstat, is executed by user with id 200"  
}

Currently I am not using any filter for this log type.  
What filter can I use to solve this error?

---

<div class="post-metadata">

**Author:** ![ParashB](https://avatars.discourse-cdn.com/v4/letter/p/b2d939/32.png) [@ParashB](https://discuss.elastic.co/u/ParashB)\
**Post date:** [April 21, 2020, 6:30am UTC](https://discuss.elastic.co/t/need-help-with-date-filter/228968/2 "2020-04-21T06:30:54Z")

</div>

Can you please paste your logstash configuration as well.

---

<div class="post-metadata">

**Author:** ![back2base](https://avatars.discourse-cdn.com/v4/letter/b/c5a1d2/32.png) [@back2base](https://discuss.elastic.co/u/back2base)\
**Post date:** [April 21, 2020, 6:50am UTC](https://discuss.elastic.co/t/need-help-with-date-filter/228968/3 "2020-04-21T06:50:27Z")

</div>

My config looks like this

input {  
beats {  
port =\> 5044  
}  
udp {  
port =\> 5114  
codec =\> "json"  
type =\> "rsyslog\_aix"  
}  
}  
filter {  
if [type] == "nginx\_access" {  
grok {  
match =\> { "message" =\> "%{IPORHOST:remote\_ip} - %{DATA:user} [%{HTTPDATE:access\_time}] "%{WORD:http\_method} %{DATA:url} HTTP/%{NUMBER:http\_version}" %{NUMBER:response\_code} %{NUMBER:body\_sent\_bytes} "%{DATA:referrer}" "%{DATA:agent}"" }  
}  
date {  
match =\> ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]  
}  
geoip {  
source =\> "remote\_ip"  
target =\> "geoip"  
add\_tag =\> ["nginx-geoip"]  
}  
}  
}  
output {  
if [type] == "nginx\_access" {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "nginx-%{+YYYY.MM.dd}"  
}  
}  
else if "winlogs" in [tags] {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "winlogs-%{+YYYY.MM.dd}"  
}  
}  
else if [type] == "rsyslog\_aix" {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "rsyslog\_aix-%{+YYYY.MM.dd}"  
}  
}  
else {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "unknown\_messages"  
}  
}  
#stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 19, 2020, 6:51am UTC](https://discuss.elastic.co/t/need-help-with-date-filter/228968/4 "2020-05-19T06:51:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.