# Another @timestamp question... non-standard timestamp transformation

**URL:** https://discuss.elastic.co/t/another-timestamp-question-non-standard-timestamp-transformation/197017
**Category:** Logstash
**Created:** [August 28, 2019, 12:02am UTC](https://discuss.elastic.co/t/another-timestamp-question-non-standard-timestamp-transformation/197017 "2019-08-28T00:02:27Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![Kalydrae](https://avatars.discourse-cdn.com/v4/letter/k/e68b1a/32.png) [@Kalydrae](https://discuss.elastic.co/u/Kalydrae)
#### Post date: [August 28, 2019, 12:28am UTC](https://discuss.elastic.co/t/another-timestamp-question-non-standard-timestamp-transformation/197017/3 "2019-08-28T00:28:51Z")

</div>

I have no idea about the replace\_timestamp field - i was following some of the other posts here and I don't really understand and I can't find the documentation very thorough for me.

> [@Looking for idea to preprocess logs](https://discuss.elastic.co/t/looking-for-idea-to-preprocess-logs/166113/2):
>
> Instead of pre-order the data, use the timestamp from the event and set that as the timestamp to index in elasticsearch. Then it nicely sorted in kibana when you view the data.. You can use a filter like this (this does not match your timestamp, it is just an example). filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:replace\_timestamp}" } } date { match =\> ['replace\_timestamp', 'yyyy-MM-dd HH:mm:ss'] timezone =\> "UTC" target =\> "@timestamp" …

I have no idea If i can use the multiple items i've already grokked to do this?

CSV filter.... ok i'll look that up. Thank you.

New config:

> filter {  
> csv {  
> separator =\> ","  
> columns =\> ["line","record","date","time","source","site","+/-","event","mode","user","details"]  
> add\_field =\> { "replace\_timestamp" =\> "%{date} %{time}" }  
> }  
> date {  
> match =\> ["replace\_timestamp", "ddMMMyy kk:mm:ss"]  
> target =\> "@timestamp"  
> }  
> }

Now the output looks like this:

> {  
> "site" =\> "328",  
> "@timestamp" =\> 2019-08-28T00:37:51.491Z,  
> "mode" =\> "Isol",  
> **\> "tags" =\> [**  
> **\> [0] "\_dateparsefailure"**  
> **\> ],**  
> "message" =\> "38415,25499,01Jul19,00:04:06,WOL,328,+,LM,Isol,,TEXT",  
> "replace\_timestamp" =\> "01Jul19 00:04:06",  
> "+/-" =\> "+",  
> "time" =\> "00:04:06",  
> "details" =\> "TEXT",  
> "line" =\> "38415",  
> "user" =\> nil,  
> "source" =\> "WOL",  
> "event" =\> "LM",  
> "@version" =\> "1",  
> "host" =\> "elasticsearch",  
> "record" =\> "25499",  
> "date" =\> "01Jul19",  
> "path" =\> "/home/elasticsearch/eventlogs/sm\_WOL\_July.csv"  
> }

Looks like it can create the replace timestamp field now, but can't parse it?  
Thank you!

---

_[View the full topic](https://discuss.elastic.co/t/another-timestamp-question-non-standard-timestamp-transformation/197017)._