# Reading date format in logstash date filter

**URL:** <https://discuss.elastic.co/t/reading-date-format-in-logstash-date-filter/329070>\
**Category:** Logstash\
**Created:** [March 31, 2023, 5:24pm UTC](https://discuss.elastic.co/t/reading-date-format-in-logstash-date-filter/329070 "2023-03-31T17:24:07Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![UsmanNiazi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/usmanniazi/32/99100_2.png) [@UsmanNiazi](https://discuss.elastic.co/u/UsmanNiazi)\
**Post date:** [March 31, 2023, 5:24pm UTC](https://discuss.elastic.co/t/reading-date-format-in-logstash-date-filter/329070/1 "2023-03-31T17:24:07Z")

</div>

Hi,

I am unable to convert this string "03/31/2023 03:15 AM PDT" to date when using logstash date filter. Getting error dateparse failure.

I am using below script  
date {  
match =\> ["start\_time", "mm/dd/yyyy HH:mm Z","MMM d yyyy HH:mm:ss", "ISO8601"]  
target =\> "start\_date"

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 31, 2023, 6:49pm UTC](https://discuss.elastic.co/t/reading-date-format-in-logstash-date-filter/329070/2 "2023-03-31T18:49:19Z")

</div>

PDT is ambiguous. You are missing an "a" to consume the AM/PM, you have a timezone id (ZZZ) not a numeric offset, you want either hh or KK rather than HH, and months are MM (mm are minutes).

```
    mutate { gsub => ["message", "PDT", "PST8PDT"] }
    date { match => ["message", "MM/dd/yyyy hh:mm a ZZZ"] target => "start_date" }

```

will produce

```
   "message" => "03/31/2023 03:15 AM PST8PDT",
"start_date" => 2023-03-31T10:15:00.000Z

```

---

<div class="post-metadata">

**Author:** ![UsmanNiazi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/usmanniazi/32/99100_2.png) [@UsmanNiazi](https://discuss.elastic.co/u/UsmanNiazi)\
**Post date:** [March 31, 2023, 7:07pm UTC](https://discuss.elastic.co/t/reading-date-format-in-logstash-date-filter/329070/3 "2023-03-31T19:07:06Z")

</div>

![date](https://us1.discourse-cdn.com/elastic/original/3X/0/f/0f3def6485b49bd65944c93d64b1f8ede3b38e4a.png)

Still getting the below error  
"start\_time" =\> "03/30/2023 11:35 PM PDT",  
"tags" =\> [  
[0] "\_dateparsefailure"  
],

---

<div class="post-metadata">

**Author:** ![UsmanNiazi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/usmanniazi/32/99100_2.png) [@UsmanNiazi](https://discuss.elastic.co/u/UsmanNiazi)\
**Post date:** [March 31, 2023, 7:08pm UTC](https://discuss.elastic.co/t/reading-date-format-in-logstash-date-filter/329070/4 "2023-03-31T19:08:30Z")

</div>

Here is my input section `filter {  
csv {

# separator =\> ","

```
	skip_header => "true"
    columns => ["name","project_name","execution_source","requested_at","start_time","end_time","duration(sec)","status","execution_uid","workflow_uid"]
 }

```

mutate {  
convert =\> ["duration(sec)", "float"]

# gsub =\> ["start\_time", "PDT", "PDT"]

```
     remove_field => ["message","host","path","@version","@timestamp"]
}

```

mutate {  
gsub =\> ["message", "PDT", "PST8PDT"] }  
date {  
match =\> ["start\_time", "MM/dd/yyyy hh:mm a ZZZ"]  
target =\> "start\_date" }  
}`

---

<div class="post-metadata">

**Author:** ![UsmanNiazi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/usmanniazi/32/99100_2.png) [@UsmanNiazi](https://discuss.elastic.co/u/UsmanNiazi)\
**Post date:** [March 31, 2023, 7:14pm UTC](https://discuss.elastic.co/t/reading-date-format-in-logstash-date-filter/329070/5 "2023-03-31T19:14:20Z")

</div>

It worked but its showing 5 hours back time in date.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 31, 2023, 7:19pm UTC](https://discuss.elastic.co/t/reading-date-format-in-logstash-date-filter/329070/6 "2023-03-31T19:19:36Z")

</div>

5 hours back from what? The start\_date field will always be UTC, so today it will be 7 hours ahead of PDT.

---

<div class="post-metadata">

**Author:** ![UsmanNiazi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/usmanniazi/32/99100_2.png) [@UsmanNiazi](https://discuss.elastic.co/u/UsmanNiazi)\
**Post date:** [March 31, 2023, 7:20pm UTC](https://discuss.elastic.co/t/reading-date-format-in-logstash-date-filter/329070/7 "2023-03-31T19:20:52Z")

</div>

In csv file time is 5am and in elastic its showing 10am

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 31, 2023, 7:45pm UTC](https://discuss.elastic.co/t/reading-date-format-in-logstash-date-filter/329070/8 "2023-03-31T19:45:21Z")

</div>

That would be expected if your server were in (for example) Asia/Karachi. If you need to tell the date filter what timezone the data in the csv is in then use the [timezone](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-timezone) option.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2023, 7:45pm UTC](https://discuss.elastic.co/t/reading-date-format-in-logstash-date-filter/329070/9 "2023-04-28T19:45:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.