# Unble to convert to date string field

**URL:** <https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661>\
**Category:** Logstash\
**Created:** [June 22, 2021, 1:52pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661 "2021-06-22T13:52:20Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![casquero](https://avatars.discourse-cdn.com/v4/letter/c/ed8c4c/32.png) [@casquero](https://discuss.elastic.co/u/casquero)\
**Post date:** [June 22, 2021, 1:52pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661/1 "2021-06-22T13:52:20Z")

</div>

I've tried to create a new field as date but always appears as string in Kibana, I've done the following:

```auto
  mutate {
    add_field => {
      "timestampTest" => "%{localisodate}"
    }
  }
  date {
    match => ["timestampTest", "YYYY.MM.dd"]
    target => "@timestamp"
  }

```

localisodate is a field captured in an event like:

```auto
code => 'myArray=event.get("message").split("|", -1)
event.set("localisodate",myArray[0])

```

Result in kibana:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c50f654176826db3ce8cddc71c1c6d686980d8ec.png)

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [June 22, 2021, 1:55pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661/2 "2021-06-22T13:55:38Z")

</div>

because you are not changing timestampTest with date

here is you have problem.

date {  
match =\> ["timestampTest", "YYYY.MM.dd"]  
target =\> "timestampTest"  
}

---

<div class="post-metadata">

**Author:** ![casquero](https://avatars.discourse-cdn.com/v4/letter/c/ed8c4c/32.png) [@casquero](https://discuss.elastic.co/u/casquero)\
**Post date:** [June 22, 2021, 1:59pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661/3 "2021-06-22T13:59:24Z")

</div>

After changing the target still persits as String

```auto
date {
    match => ["timestampTest", "YYYY.MM.dd"]
    target => "timestampTest"
  }

```

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/9/99f3dc3666a236fb8137d0803127924dc722c33a.png)

---

<div class="post-metadata">

**Author:** ![casquero](https://avatars.discourse-cdn.com/v4/letter/c/ed8c4c/32.png) [@casquero](https://discuss.elastic.co/u/casquero)\
**Post date:** [June 22, 2021, 1:59pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661/4 "2021-06-22T13:59:59Z")

</div>

I've also created a new Kibana index

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [June 22, 2021, 2:01pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661/5 "2021-06-22T14:01:34Z")

</div>

what is the output when you run this on commandline?

---

<div class="post-metadata">

**Author:** ![casquero](https://avatars.discourse-cdn.com/v4/letter/c/ed8c4c/32.png) [@casquero](https://discuss.elastic.co/u/casquero)\
**Post date:** [June 22, 2021, 2:04pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661/6 "2021-06-22T14:04:40Z")

</div>

What do u mean with running in commandline? I am noob with ELK... ☹

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [June 22, 2021, 2:08pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661/7 "2021-06-22T14:08:21Z")

</div>

ok what is your original timestampTest value? 2021.06.20 something like this?

---

<div class="post-metadata">

**Author:** ![casquero](https://avatars.discourse-cdn.com/v4/letter/c/ed8c4c/32.png) [@casquero](https://discuss.elastic.co/u/casquero)\
**Post date:** [June 22, 2021, 2:12pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661/8 "2021-06-22T14:12:46Z")

</div>

The field comes from different log traces and it takes several values, like this:

![image](https://us1.discourse-cdn.com/elastic/original/3X/c/1/c18d69bc49da4ebf4145f7edc926aacd971cc29a.png)

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [June 22, 2021, 2:53pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661/9 "2021-06-22T14:53:55Z")

</div>

ok. your original post didn't had this and hence no way to tell anything.  
your date matching is wrong.

and please don't post pic. as we can't cut-paste from it.

Here are some example  
2021-06-22  
date { match =\> ["timestampTest", "yyyy-MM-dd"]  
target =\> "timestampTest" }

2021-06-22 16:12:12  
date { match =\> ["timestampTest", "yyyy-MM-dd HH:mm:ss"]  
target =\> "timestampTest" }

2021-06-22 16:12:12,413  
date { match =\> ["timestampTest", "yyyy-MM-dd HH:mm:ss,SSS"]  
target =\> "timestampTest" }

and for your original message  
2021-06-2216:12:12,413  
date { match =\> ["timestampTest", "yyyy-MM-ddHH:mm:ss,SSS"]  
target =\> "timestampTest" }

Here is how do quick test for any small test like this. There is also way you can do it from whole thing on command line.

I have quick\_test.conf file

```auto
input {
   generator {
     message => '{"num": 101, "timestampTest":"2021-06-2216:12:12,413"}' 
      count => 1
   }
}

filter {
   json { source => "message" }
     date { match => ["timestampTest", "yyyy-MM-ddHH:mm:ss,SSS"]
          target => "timestampTest" }
}

output {
 stdout { codec => rubydebug }
}

```

and then I run this from command line

/usr/share/logstash/bin/logstash -f quick\_test.conf

---

<div class="post-metadata">

**Author:** ![casquero](https://avatars.discourse-cdn.com/v4/letter/c/ed8c4c/32.png) [@casquero](https://discuss.elastic.co/u/casquero)\
**Post date:** [June 22, 2021, 6:14pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661/10 "2021-06-22T18:14:18Z")

</div>

that worked thanks!

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [June 22, 2021, 6:30pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661/11 "2021-06-22T18:30:09Z")

</div>

Great, mark thread as solved, that way if someone else search on it. they will easily know it

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2021, 6:30pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661/12 "2021-07-20T18:30:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.