# Reference key from kv filter to use in date filter

**URL:** <https://discuss.elastic.co/t/reference-key-from-kv-filter-to-use-in-date-filter/171389>\
**Category:** Logstash\
**Created:** [March 7, 2019, 10:32pm UTC](https://discuss.elastic.co/t/reference-key-from-kv-filter-to-use-in-date-filter/171389 "2019-03-07T22:32:24Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jeba\_Bhaskaran](https://avatars.discourse-cdn.com/v4/letter/j/71e660/32.png) [@Jeba\_Bhaskaran](https://discuss.elastic.co/u/Jeba_Bhaskaran)\
**Post date:** [March 7, 2019, 10:32pm UTC](https://discuss.elastic.co/t/reference-key-from-kv-filter-to-use-in-date-filter/171389/1 "2019-03-07T22:32:24Z")

</div>

Hello, I am using a kv filter to split text and then need to use a field from the split text as @timestamp.

Here is filter snippet from from my config file

filter {  
kv { }  
date {  
match =\> ["%{start}", "UNIX"]  
target =\> "@timestamp"  
}  
}

The timestamp is in field called 'start'.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 7, 2019, 10:36pm UTC](https://discuss.elastic.co/t/reference-key-from-kv-filter-to-use-in-date-filter/171389/2 "2019-03-07T22:36:44Z")

</div>

What is your question?

---

<div class="post-metadata">

**Author:** ![Jeba\_Bhaskaran](https://avatars.discourse-cdn.com/v4/letter/j/71e660/32.png) [@Jeba\_Bhaskaran](https://discuss.elastic.co/u/Jeba_Bhaskaran)\
**Post date:** [March 7, 2019, 11:44pm UTC](https://discuss.elastic.co/t/reference-key-from-kv-filter-to-use-in-date-filter/171389/3 "2019-03-07T23:44:54Z")

</div>

timestamp field is not getting replaced with value from start.

---

<div class="post-metadata">

**Author:** ![Jeba\_Bhaskaran](https://avatars.discourse-cdn.com/v4/letter/j/71e660/32.png) [@Jeba\_Bhaskaran](https://discuss.elastic.co/u/Jeba_Bhaskaran)\
**Post date:** [March 7, 2019, 11:47pm UTC](https://discuss.elastic.co/t/reference-key-from-kv-filter-to-use-in-date-filter/171389/4 "2019-03-07T23:47:17Z")

</div>

Here is a snippet of the text that the kv filter is spliting

cs7=34.0756 cs7Label=latitude cs8=-84.6477 cs8Label=longitude Customer=asdf ver= TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 start=1551914758690 [request=some.some.com](http://request=some.some.com) requestMethod=POST

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 8, 2019, 12:38am UTC](https://discuss.elastic.co/t/reference-key-from-kv-filter-to-use-in-date-filter/171389/5 "2019-03-08T00:38:39Z")

</div>

You do not need a sprintf reference, just give it the name of the field. Also, [start] is in milliseconds.

```
date { match => ["start", "UNIX_MS"] }

```

Also, if you are reading CEF messages from an input then a cef [codec](https://www.elastic.co/guide/en/logstash/6.6/plugins-codecs-cef.html) might help you. But only if the messages are pure CEF. If there is a header or trailer the codec will not work. (Personally I would love to see a cef filter in addition to a cef codec.)

---

<div class="post-metadata">

**Author:** ![Jeba\_Bhaskaran](https://avatars.discourse-cdn.com/v4/letter/j/71e660/32.png) [@Jeba\_Bhaskaran](https://discuss.elastic.co/u/Jeba_Bhaskaran)\
**Post date:** [March 8, 2019, 1:36am UTC](https://discuss.elastic.co/t/reference-key-from-kv-filter-to-use-in-date-filter/171389/6 "2019-03-08T01:36:29Z")

</div>

That worked. Thanks for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2019, 1:36am UTC](https://discuss.elastic.co/t/reference-key-from-kv-filter-to-use-in-date-filter/171389/7 "2019-04-05T01:36:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.