# Strugging with the date filter

**URL:** <https://discuss.elastic.co/t/strugging-with-the-date-filter/137648>\
**Category:** Logstash\
**Created:** [June 27, 2018, 2:48pm UTC](https://discuss.elastic.co/t/strugging-with-the-date-filter/137648 "2018-06-27T14:48:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JonConnor](https://avatars.discourse-cdn.com/v4/letter/j/65b543/32.png) [@JonConnor](https://discuss.elastic.co/u/JonConnor)\
**Post date:** [June 27, 2018, 2:48pm UTC](https://discuss.elastic.co/t/strugging-with-the-date-filter/137648/1 "2018-06-27T14:48:27Z")

</div>

Having a difficult time with the data filter. the 'message' field contains:

2018.06.27 00:22:23:209 UTC | FieldDebug | CommonPersistency

my logstash filter:

filter {  
date {  
match =\> ["message", "yyyy.MM.dd HH:mm:ss:SSS ZZZ"]  
target =\> "@timestamp"  
}  
}

Tried different variations of the timezone ZZZ =\> no space between S and Z, single Z, not including it in the match). all results in \_dateparsefailure.

Any advice on what i'm doing wrong ?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 27, 2018, 3:05pm UTC](https://discuss.elastic.co/t/strugging-with-the-date-filter/137648/2 "2018-06-27T15:05:00Z")

</div>

You need to first separate out the timestamp part into a separate field, e.g. using dissect or grok, and then run the date filter on this.

---

<div class="post-metadata">

**Author:** ![JonConnor](https://avatars.discourse-cdn.com/v4/letter/j/65b543/32.png) [@JonConnor](https://discuss.elastic.co/u/JonConnor)\
**Post date:** [June 27, 2018, 5:13pm UTC](https://discuss.elastic.co/t/strugging-with-the-date-filter/137648/3 "2018-06-27T17:13:08Z")

</div>

DOH...thanks wasn't sure if date was in place of grok.

Some advice on the grok filter then? I created a custom pattern:

DATESTAMP\_LOGFILE %{YEAR}.%{MONTHNUM2}.%{MONTHDAY} %{TIME} %{TZ}

which is loaded ok when i start logstash. but getting grok\_parse errors now:

logstash config:  
filter {  
grok {  
patterns\_dir =\> ["/app/custom.Grok.Patterns"]  
match =\> ["message", "%{DATESTAMP\_LOGFILE:log\_timestamp"]  
}

date {  
match =\> ["log\_timestamp", "yyyy.MM.dd HH:mm:ss:SSS ZZZ"]  
target =\> "@timestamp"  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 25, 2018, 5:13pm UTC](https://discuss.elastic.co/t/strugging-with-the-date-filter/137648/4 "2018-07-25T17:13:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.