# Add @timestamp according to actual syslog date-time

**URL:** <https://discuss.elastic.co/t/add-timestamp-according-to-actual-syslog-date-time/126386>\
**Category:** Logstash\
**Created:** [April 2, 2018, 7:47am UTC](https://discuss.elastic.co/t/add-timestamp-according-to-actual-syslog-date-time/126386 "2018-04-02T07:47:12Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![pkaramol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkaramol/32/22610_2.png) [@pkaramol](https://discuss.elastic.co/u/pkaramol)\
**Post date:** [April 2, 2018, 7:47am UTC](https://discuss.elastic.co/t/add-timestamp-according-to-actual-syslog-date-time/126386/1 "2018-04-02T07:47:12Z")

</div>

I am parsing some `syslog` logs as follows:

```
grok {
      match => { 'message' => '%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}' }
    }

```

The actual logs have a `local_time` field as follows (e.g.):

```
local_time="21/Jun/2015:23:45:39 +0300"

```

I want the `@timestamp` field of the document to take the value of the above field.

How can this be achieved?

**edit** : the following is still giving a `@timestamp` with value equal to the **current** time, not the value of the `local_time` field.

```
 date {
  target => "@timestamp"
  match => ["local_time", "dd/MMM/YYYY:HH:MM:ss Z"]
  tag_on_failure => ["no_date_match"]
 }
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 2, 2018, 9:49am UTC](https://discuss.elastic.co/t/add-timestamp-according-to-actual-syslog-date-time/126386/2 "2018-04-02T09:49:19Z")

</div>

So you're getting a `no_date_match` tag in the resulting documents? Have you looked in the Logstash log for clues? The date filter logs details about any parse errors.

---

<div class="post-metadata">

**Author:** ![pkaramol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkaramol/32/22610_2.png) [@pkaramol](https://discuss.elastic.co/u/pkaramol)\
**Post date:** [April 2, 2018, 9:59am UTC](https://discuss.elastic.co/t/add-timestamp-according-to-actual-syslog-date-time/126386/3 "2018-04-02T09:59:51Z")

</div>

Actually I am using the docker ELK stack and it doesn't output any parsing errors...

Any idea how can I further debug this?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 2, 2018, 10:48am UTC](https://discuss.elastic.co/t/add-timestamp-according-to-actual-syslog-date-time/126386/4 "2018-04-02T10:48:07Z")

</div>

> Actually I am using the docker ELK stack and it doesn't output any parsing errors...

Not true. It's always possible to read the Logstash logs. What Docker image are you using and how are you starting the container?

---

<div class="post-metadata">

**Author:** ![pkaramol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkaramol/32/22610_2.png) [@pkaramol](https://discuss.elastic.co/u/pkaramol)\
**Post date:** [April 2, 2018, 10:50am UTC](https://discuss.elastic.co/t/add-timestamp-according-to-actual-syslog-date-time/126386/5 "2018-04-02T10:50:01Z")

</div>

I am using this project: [https://github.com/deviantony/docker-elk](https://github.com/deviantony/docker-elk)

And always starting it with `docker-compose rm -f && docker-compose up`

---

<div class="post-metadata">

**Author:** ![pkaramol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkaramol/32/22610_2.png) [@pkaramol](https://discuss.elastic.co/u/pkaramol)\
**Post date:** [April 2, 2018, 2:45pm UTC](https://discuss.elastic.co/t/add-timestamp-according-to-actual-syslog-date-time/126386/6 "2018-04-02T14:45:13Z")

</div>

> [@pkaramol](#):
>
> match =\> ["local\_time", "dd/MMM/YYYY:HH:MM:ss Z"]

The mapping was failing because the minutes need to be in **lowercase**'m'...

I was using capital 'M'...

The topic can be closed I guess...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 30, 2018, 2:45pm UTC](https://discuss.elastic.co/t/add-timestamp-according-to-actual-syslog-date-time/126386/7 "2018-04-30T14:45:15Z")

</div>

Closed on April 30, 2018, 2:45pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.