{"action":"created","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/issues/51","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/issues/51/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/issues/51/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/issues/51/events","html_url":"https://github.com/logstash-plugins/logstash-filter-date/issues/51","id":122683142,"number":51,"title":"Default year, month and date when not specified","user":{"login":"ppf2","id":7216393,"avatar_url":"https://avatars.githubusercontent.com/u/7216393?v=3","gravatar_id":"","url":"https://api.github.com/users/ppf2","html_url":"https://github.com/ppf2","followers_url":"https://api.github.com/users/ppf2/followers","following_url":"https://api.github.com/users/ppf2/following{/other_user}","gists_url":"https://api.github.com/users/ppf2/gists{/gist_id}","starred_url":"https://api.github.com/users/ppf2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ppf2/subscriptions","organizations_url":"https://api.github.com/users/ppf2/orgs","repos_url":"https://api.github.com/users/ppf2/repos","events_url":"https://api.github.com/users/ppf2/events{/privacy}","received_events_url":"https://api.github.com/users/ppf2/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/labels/discuss","name":"discuss","color":"cc317c"},{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/labels/enhancement","name":"enhancement","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-12-17T08:01:53Z","updated_at":"2015-12-30T00:01:40Z","closed_at":null,"body":"Currently in LS 2.1, the following is the behavior when the date filter encounters a datetime field without the full \"date\" portion of the datetime.\r\n\r\nExample 1:\r\n\r\nWhen `no date information is provided, and only the time is available`, we default the `year to 1970, month to 01 and day to 01`.\r\n\r\n```\r\n15:52:54,138 -> 1970-01-01T23:52:54.138Z\r\n```\r\n\r\nExample 2:\r\n\r\nWhen `no year information is provided, and only the month and day is available`, we `default the year to be the current year` (or based on the logic [here](https://github.com/logstash-plugins/logstash-filter-date/pull/4))\r\n\r\n```\r\n10-03 15:52:54,138 -> 2015-10-03T22:52:54.138Z\r\n```\r\n\r\nExample 3:\r\n\r\nWhen `no year and month information are provided, and only the day is available`, we `default the year to be the current year and the month to be 01`\r\n\r\n```\r\n03 15:52:54,138 -> 2015-01-03T23:52:54.138Z\r\n```\r\n\r\nIt may be nice for the user to define what they want the year and month to default to.  The 2nd and 3rd cases above seem to have sensible defaults - year to current year (or based on logic in PR 4), and month to 01.  But the behavior of the 1st use case seems inconsistent since it defaults to 1970 instead of the current year (perhaps we can make it configurable for the end user to decide what they want this (or a datetime with no actual date information) to default to?) \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/issues/comments/167902497","html_url":"https://github.com/logstash-plugins/logstash-filter-date/issues/51#issuecomment-167902497","issue_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-date/issues/51","id":167902497,"user":{"login":"ppf2","id":7216393,"avatar_url":"https://avatars.githubusercontent.com/u/7216393?v=3","gravatar_id":"","url":"https://api.github.com/users/ppf2","html_url":"https://github.com/ppf2","followers_url":"https://api.github.com/users/ppf2/followers","following_url":"https://api.github.com/users/ppf2/following{/other_user}","gists_url":"https://api.github.com/users/ppf2/gists{/gist_id}","starred_url":"https://api.github.com/users/ppf2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ppf2/subscriptions","organizations_url":"https://api.github.com/users/ppf2/orgs","repos_url":"https://api.github.com/users/ppf2/repos","events_url":"https://api.github.com/users/ppf2/events{/privacy}","received_events_url":"https://api.github.com/users/ppf2/received_events","type":"User","site_admin":false},"created_at":"2015-12-30T00:01:40Z","updated_at":"2015-12-30T00:01:40Z","body":"Certainly agree on the guesswork being complicated.  It is probably sufficient to simply document our current \"guess\" logic.  I think the guesswork for most of these examples are sensible today, other than the first example where there is no date at all (just time info).  For this case, it seems better to default to the current date vs. 1970-01-01 for new log lines writing out just time information is more likely to be today's date.  Having it default to 1970 means that these log events will likely be missed from user queries since most users will not be looking for events that are that old.  "}}