# Accessing a timestamp within a json structure to be used as @timestamp

**URL:** <https://discuss.elastic.co/t/accessing-a-timestamp-within-a-json-structure-to-be-used-as-timestamp/196307>\
**Category:** Logstash\
**Created:** [August 22, 2019, 11:36am UTC](https://discuss.elastic.co/t/accessing-a-timestamp-within-a-json-structure-to-be-used-as-timestamp/196307 "2019-08-22T11:36:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Franco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/franco/32/52614_2.png) [@Franco](https://discuss.elastic.co/u/Franco)\
**Post date:** [August 22, 2019, 11:36am UTC](https://discuss.elastic.co/t/accessing-a-timestamp-within-a-json-structure-to-be-used-as-timestamp/196307/1 "2019-08-22T11:36:51Z")

</div>

Hi all.

I'm currently trying to parse a json log format like that:

`{"rmiCall":{"method":"jDVServer#getDocnrs","objectInfo":"jdv.server.jDVServer@53dacd14","params":["jdv.server.doc.vvdoc.VVDoc",{"PROJECT":"vvrp","WORDDOKID":"VVRP000000246.docx"}]},"@timestamp":"2019-08-12T21:00:40.613Z","rmiClient":"10.65.9.50","correlationId":"PuoJEoWVad5Xz68C"}`

I want to read the existing @timestamp within the rmi\_message and set it as default @timestamp with that filter:

```
	   json {
	      source => "message"
	      target => "rmi_message"
	   }
	   date {
	       match => ["rmi_message.@timestamp" , "yyyy-MM-dd'T'HH:mm:ss.SSS", "yyyy-MM-dd'T'HH:mm:ss.SSSZ", "ISO8601"]
	       target => "@timestamp"
	   }

```

But in the output the @timestamp is the current DateTime. 😒

```
{
           "host" => "jdv-logdev",
     "@timestamp" => 2019-08-22T11:33:23.562Z,
    "rmi_message" => {
           "@timestamp" => "2019-08-12T21:00:40.613Z",
            "rmiClient" => "10.65.9.50",
              "rmiCall" => {
                "method" => "jDVServer#getDocnrs",
            "objectInfo" => "jdv.server.jDVServer@53dacd14",
                "params" => [
                [0] "jdv.server.doc.vvdoc.VVDoc",
                [1] {
                      "PROJECT" => "vvrp",
                    "WORDDOKID" => "VVRP000000246.docx"
                }
            ]
        },
        "correlationId" => "PuoJEoWVad5Xz68C"
    },
        "message" => "{\"rmiCall\":{\"method\":\"jDVServer#getDocnrs\",\"objectInfo\":\"jdv.server.jDVServer@53dacd14\",\"params\":[\"jdv.server.doc.vvdoc.VVDoc\",{\"PROJECT\":\"vvrp\",\"WORDDOKID\":\"VVRP000000246.docx\"}]},\"@timestamp\":\"2019-08-12T21:00:40.613Z\",\"rmiClient\":\"10.65.9.50\",\"correlationId\":\"PuoJEoWVad5Xz68C\"}",
       "@version" => "1"
}

```

Who can tell me what I'm doing wrong here?

Tnx in advance.  
Franco

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 22, 2019, 11:53am UTC](https://discuss.elastic.co/t/accessing-a-timestamp-within-a-json-structure-to-be-used-as-timestamp/196307/2 "2019-08-22T11:53:20Z")

</div>

> [@Franco](#):
>
> "rmi\_message.@timestamp"

That refers to a field with a dot in its name. It looks like you have an rmi\_message object that contains an @timestamp field, so you should use [rmi\_message][@timestamp]

---

<div class="post-metadata">

**Author:** ![Franco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/franco/32/52614_2.png) [@Franco](https://discuss.elastic.co/u/Franco)\
**Post date:** [August 22, 2019, 12:16pm UTC](https://discuss.elastic.co/t/accessing-a-timestamp-within-a-json-structure-to-be-used-as-timestamp/196307/3 "2019-08-22T12:16:58Z")

</div>

Seems you're becoming my buddy, Badger. 😉

2 Questions 2 Answers that solve my probs. 👍

Tnx u verry much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2019, 12:16pm UTC](https://discuss.elastic.co/t/accessing-a-timestamp-within-a-json-structure-to-be-used-as-timestamp/196307/4 "2019-09-19T12:16:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.