# Parse timestamp using date filter plugin

**URL:** <https://discuss.elastic.co/t/parse-timestamp-using-date-filter-plugin/237641>\
**Category:** Logstash\
**Created:** [June 18, 2020, 1:16pm UTC](https://discuss.elastic.co/t/parse-timestamp-using-date-filter-plugin/237641 "2020-06-18T13:16:49Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![marco2005](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@marco2005](https://discuss.elastic.co/u/marco2005)\
**Post date:** [June 18, 2020, 1:16pm UTC](https://discuss.elastic.co/t/parse-timestamp-using-date-filter-plugin/237641/1 "2020-06-18T13:16:49Z")

</div>

I have a log line:

`test-process 2020/06/04 13:35:42 process.go:646: INFO: GetTest: X-Request-Id: 14242dqdq2aA, status: HTTP 200 OK`

Below is my filter:

```
filter {
        dissect {
            mapping => {
                "message" => "%{process} %{timestamp} %{+timestamp} %{function} %{log_level} %{msg}"
            }
            remove_tag => ["_dissectfailure"]
        }
        mutate {
            gsub => [
                "message", "\s*\|\s*", "|",
                "log_level", ":$", "" ,
                "function", ":$", ""
            ]
            remove_field => ["process"]
        }
        date {
            match => ["timestamp" , "YYYY/MM/DD HH:mm:ss"]
            target => "timestamp"
        }
        kv {
            field_split => "|"
        }
}

```

The problem is with the timestamp in the output. It is "2020-01-04" instead of "2020-06-04" . How can I fix it ?

```
{
       "message" => "test-process 2020/06/04 13:35:42 process.go:646: INFO: GetTest: X-Request-Id: 14242dqdq2aA, status: HTTP 200 OK",
     "log_level" => "INFO",
           "msg" => "GetTest: X-Request-Id: 14242dqdq2aA, status: HTTP 200 OK",
    "@timestamp" => 2020-06-18T12:53:25.219Z,
      "@version" => "1",
      "function" => "process.go:646",
          "host" => "test.example.com",
     "timestamp" => 2020-01-04T12:35:42.000Z
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 18, 2020, 2:55pm UTC](https://discuss.elastic.co/t/parse-timestamp-using-date-filter-plugin/237641/2 "2020-06-18T14:55:37Z")

</div>

> [@marco2005](#):
>
> `"YYYY/MM/DD HH:mm:ss"`

DD is day of the year, which overrides month. Use dd, which is day of the month.

---

<div class="post-metadata">

**Author:** ![marco2005](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@marco2005](https://discuss.elastic.co/u/marco2005)\
**Post date:** [June 18, 2020, 3:46pm UTC](https://discuss.elastic.co/t/parse-timestamp-using-date-filter-plugin/237641/3 "2020-06-18T15:46:59Z")

</div>

Thanks a lot it fixed the issue

---

<div class="post-metadata">

**Author:** ![marco2005](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@marco2005](https://discuss.elastic.co/u/marco2005)\
**Post date:** [June 18, 2020, 4:27pm UTC](https://discuss.elastic.co/t/parse-timestamp-using-date-filter-plugin/237641/4 "2020-06-18T16:27:21Z")

</div>

Can we also get rid of "@timestamp" =\> 2020-06-18T12:53:25.219Z," and just use "timestamp" =\> 2020-06-04T12:35:42.000Z instead ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 18, 2020, 5:09pm UTC](https://discuss.elastic.co/t/parse-timestamp-using-date-filter-plugin/237641/5 "2020-06-18T17:09:25Z")

</div>

It is possible to remove @timestamp, but some functionality requires it, so it may break things. For example, sprintf references to a date, such as "logstash-%{+yyyy.MM.dd}" always use @timestamp, so it will resolve to "logstash-". That is just an example, there may be other things.

---

<div class="post-metadata">

**Author:** ![marco2005](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@marco2005](https://discuss.elastic.co/u/marco2005)\
**Post date:** [June 18, 2020, 5:19pm UTC](https://discuss.elastic.co/t/parse-timestamp-using-date-filter-plugin/237641/6 "2020-06-18T17:19:51Z")

</div>

How to make sure that @timestamp uses 020-06-04T12:35:42.000Z instead of 2020-06-18T12:53:25.219Z ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 18, 2020, 5:22pm UTC](https://discuss.elastic.co/t/parse-timestamp-using-date-filter-plugin/237641/7 "2020-06-18T17:22:33Z")

</div>

Either remove the target option from the date filter, so that it sets @timestamp, or else use [mutate+copy](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-copy) to copy [timestamp] to [@timestamp].

---

<div class="post-metadata">

**Author:** ![marco2005](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@marco2005](https://discuss.elastic.co/u/marco2005)\
**Post date:** [June 18, 2020, 5:36pm UTC](https://discuss.elastic.co/t/parse-timestamp-using-date-filter-plugin/237641/8 "2020-06-18T17:36:00Z")

</div>

Thank you. Let me try this

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 16, 2020, 5:39pm UTC](https://discuss.elastic.co/t/parse-timestamp-using-date-filter-plugin/237641/9 "2020-07-16T17:39:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.