# @timestamp not updated using date filter
**URL:** https://discuss.elastic.co/t/timestamp-not-updated-using-date-filter/198277
**Category:** Logstash
**Created:** [September 5, 2019, 2:59pm UTC](https://discuss.elastic.co/t/timestamp-not-updated-using-date-filter/198277 "2019-09-05T14:59:04Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@holobolo0815](https://discuss.elastic.co/u/holobolo0815)
#### Post date: [September 5, 2019, 2:59pm UTC](https://discuss.elastic.co/t/timestamp-not-updated-using-date-filter/198277/1 "2019-09-05T14:59:04Z")
Hello,
I have the following syslog message that I'm injecting using logstash into elasticsearch:
`<189>2019-09-05T16:44:31.766338+02:00 172.x.x.x date=2019-09-05 time=16:44:30`
Using logstash I'm first putting the syslog timestamp into @timestamp
```
date {
match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601"]
}
```
Later, I'm trying to interpret the date/time contained in the payload and extract using kv{}:
```
date {
match => ["%{date} %{time}", "yyyy-MM-dd HH:mm:ss"]
tag_on_failure => ["%_fail_date"]
}
```
%\_fail\_date is not set, so the statement must have been successful.
Actual result: (the time retrieved from syslog)
`@timestamp Sep 5, 2019 @ 16:44:31.766`
Expected result: (the time set later by using "date" again)
`@timestamp Sep 5, 2019 @ 16:44:30.000`
Thanks.
**UPDATE** To be on the safe side I now also set `add_tag => ["%_success_date"]`. It doesn't appear either 🤔 The code before and after calling date is run though. (Can tell by the fields that are added and removed)
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 5, 2019, 3:28pm UTC](https://discuss.elastic.co/t/timestamp-not-updated-using-date-filter/198277/2 "2019-09-05T15:28:38Z")
> [@holobolo0815](#):
>
> %\_fail\_date is not set, so the statement must have been successful.
Not true. tag\_on\_failure only occurs if the filter attempts (and fails) to match the source field. If the source field does not exist then the date filter is a no-op. I do not think a date filter accepts a sprintf reference like that, you would need to mutate+add\_field to create the field and then use a date filter to parse it.
---
### Author:  [@holobolo0815](https://discuss.elastic.co/u/holobolo0815)
#### Post date: [September 5, 2019, 3:37pm UTC](https://discuss.elastic.co/t/timestamp-not-updated-using-date-filter/198277/3 "2019-09-05T15:37:07Z")
Ok I forgot to _not_ think in binary. Thanks 🙂
This works:
```
mutate {
add_field => { "[@metadata][ts]" => "%{date} %{time}" }
}
date {
match => ["[@metadata][ts]", "yyyy-MM-dd HH:mm:ss" ]
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 3, 2019, 3:37pm UTC](https://discuss.elastic.co/t/timestamp-not-updated-using-date-filter/198277/4 "2019-10-03T15:37:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.