# Backfilling logs and timestamp

**URL:** <https://discuss.elastic.co/t/backfilling-logs-and-timestamp/55286>\
**Category:** Logstash\
**Created:** [July 12, 2016, 11:01am UTC](https://discuss.elastic.co/t/backfilling-logs-and-timestamp/55286 "2016-07-12T11:01:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![swagce](https://avatars.discourse-cdn.com/v4/letter/s/9e8a1a/32.png) [@swagce](https://discuss.elastic.co/u/swagce)\
**Post date:** [July 12, 2016, 11:01am UTC](https://discuss.elastic.co/t/backfilling-logs-and-timestamp/55286/1 "2016-07-12T11:01:38Z")

</div>

Hi everyone,

I have some issue with the "@timestamp" field when i'm importing old logs. The thing I want to do is to replace the value of the "@timestamp" with the value of when the log was created (here i'm looking at "start\_time" field).

Here's a log sample of what i'm trying to parse.  
Jun 1 00:00:00 10.1.1.1 SOMEDATA start\_time="2016-06-06 00:00:00"

Here's my configuration for parsing the logs

filter {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp} SOMEDATA start\_time=%{QUOTEDSTRING:start\_time} " }  
remove\_field =\> ["message"]  
}  
mutate {  
gsub =\> ["start\_time", """, ""]  
}  
date {  
match =\> ["start\_time", "YYYY-MM-dd HH:mm:ss"]  
remove\_field =\> ["start\_time"]  
}  
}

I'm not really sure about those two points :

- Can I replace the @timestamp with my "start\_time" even if they don't have the same format ?
- Can my problem be related to the type of the "start\_time" (I'm using the QUOTEDSTRING) ?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 12, 2016, 11:05am UTC](https://discuss.elastic.co/t/backfilling-logs-and-timestamp/55286/2 "2016-07-12T11:05:56Z")

</div>

> Can I replace the @timestamp with my "start\_time" even if they don't have the same format ?

Yes. The whole point of the date filter is to parse timestamps in various formats into one canonical representation.

> Can my problem be related to the type of the "start\_time" (I'm using the QUOTEDSTRING) ?

Yes. IIRC the QUOTEDSTRING pattern includes the quote in the capture, i.e. the start\_time field will contain `"2016-06-06 00:00:00"` instead of just `2016-06-06 00:00:00`. You can take that into account in the date filter but because of the configuration language's support for quoting and escapes you might want to do it by other means, like using something other than QUOTEDSTRING.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:48am UTC](https://discuss.elastic.co/t/backfilling-logs-and-timestamp/55286/3 "2017-07-06T04:48:27Z")

</div>

Closed on July 6, 2017, 4:48am UTC