# No log entry after adding date match filter

**URL:** <https://discuss.elastic.co/t/no-log-entry-after-adding-date-match-filter/69616>\
**Category:** Logstash\
**Created:** [December 20, 2016, 9:45pm UTC](https://discuss.elastic.co/t/no-log-entry-after-adding-date-match-filter/69616 "2016-12-20T21:45:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Len\_Rugen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/len_rugen/32/12801_2.png) [@Len\_Rugen](https://discuss.elastic.co/u/Len_Rugen)\
**Post date:** [December 20, 2016, 9:45pm UTC](https://discuss.elastic.co/t/no-log-entry-after-adding-date-match-filter/69616/1 "2016-12-20T21:45:09Z")

</div>

With the date fields below commented out, I get events logged, but with the wrong timestamp. Removing the comment I get nothing logged and no error messages, at least that I can find. The timezone line doesn't matter either.

Any ideal?

Thanks

```
      grok {
            match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{IPORHOST:s-ip} %{WORD:cs-method} %{URIPATH:cs-uri-stem} %{NOTSPACE:cs-uri-query} %{NUMBER:s-port} %{NOTSPACE:cs-username} %{IPORHOST:clientip} %{NOTSPACE:cs-useragent} %{NOTSPACE:referrer} %{NUMBER:sc-status} %{NUMBER:sc-substatus} %{NUMBER:sc-win32-status} %{NUMBER:time-taken}"]
      }

```

# date {

# match =\> ["log\_timestamp", "YYYY-MM-dd HH:mm:ss"]

# timezone =\> "US/Central"

# }

```
      geoip { source => "clientip" target => "geoip"}

      mutate {
          replace => { "[type]" => "iis" }
          lowercase => ["cs-username"]
          remove_field => [ "cs-method", "cs-uri-query", "s-port", "referrer", "sc-substatus", "sc-win32-status",
                           "time-taken", "message" ]
      }
```

---

<div class="post-metadata">

**Author:** ![Len\_Rugen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/len_rugen/32/12801_2.png) [@Len\_Rugen](https://discuss.elastic.co/u/Len_Rugen)\
**Post date:** [December 21, 2016, 3:18am UTC](https://discuss.elastic.co/t/no-log-entry-after-adding-date-match-filter/69616/2 "2016-12-21T03:18:45Z")

</div>

More research, no solution. With this code in the date block above

```
      date {
          match => ["log_timestamp", "YYYY-MM-dd HH:mm:ss"]
          remove_field => ["log_timestamp"]
          target => "log_timestamp_test"
      }

```

log\_timestamp\_test has the tiny clock icon and a sample displays as December 21st 2016, 03:11:42.000 and the log\_timestamp field is dropped, so I know it's going thru the code 🙂

If I make the target =\> "@timestamp", I still don't get anything sent to elasticsearch.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 21, 2016, 6:24am UTC](https://discuss.elastic.co/t/no-log-entry-after-adding-date-match-filter/69616/3 "2016-12-21T06:24:26Z")

</div>

It would probably help if you showed an example of an actual event.

---

<div class="post-metadata">

**Author:** ![Len\_Rugen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/len_rugen/32/12801_2.png) [@Len\_Rugen](https://discuss.elastic.co/u/Len_Rugen)\
**Post date:** [December 22, 2016, 4:55pm UTC](https://discuss.elastic.co/t/no-log-entry-after-adding-date-match-filter/69616/4 "2016-12-22T16:55:44Z")

</div>

I tried to add an example last night but I don't see it. Here is a log entry, with some sanitization:

2016-12-10 23:59:58 10.10.10.1 POST /EWS/Exchange.asmx &CorrelationID=;&cafeReqId=f7e635f8-e9ff-4c24-91f9-7259c4d8e5bc; 80 DOMAIN\user 192.168.0.1 Mac+OS+X/10.12.1+(16B2555)+CalendarAgent/384 - 200 0 0 15

I found that adding timezone =\> "Etc/UTC" fixed the problem.

```
     date {
          match => ["log_timestamp", "YYYY-MM-dd HH:mm:ss"]
          remove_field => ["log_timestamp"]
          target => "@timestamp"
          timezone => "Etc/UTC"
      }

```

I noticed there isn't a "Z" in the timestamp in the this log.

I'm new in ELK, we're just seeing what we can develop.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 19, 2017, 4:55pm UTC](https://discuss.elastic.co/t/no-log-entry-after-adding-date-match-filter/69616/5 "2017-01-19T16:55:59Z")

</div>

Closed on January 19, 2017, 4:55pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.