# Can't modify the @timestamp field via logstash

**URL:** <https://discuss.elastic.co/t/cant-modify-the-timestamp-field-via-logstash/364009>\
**Category:** Logstash\
**Created:** [July 29, 2024, 8:35pm UTC](https://discuss.elastic.co/t/cant-modify-the-timestamp-field-via-logstash/364009 "2024-07-29T20:35:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gur-Sin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gur-sin/32/136383_2.png) [@Gur-Sin](https://discuss.elastic.co/u/Gur-Sin)\
**Post date:** [July 29, 2024, 8:35pm UTC](https://discuss.elastic.co/t/cant-modify-the-timestamp-field-via-logstash/364009/1 "2024-07-29T20:35:13Z")

</div>

Hi,  
I recently had to migrate data from one index to another and wanted to maintain the original timestamps as in the original index. I have used the date plugin to achieve the same and it seems to work when I pipe the output to a local JSON file on my computer but fails when I push it to Elasticsearch and preview the documents in Kibana. I have attached my Logstash config file, can someone help me understand why the intended change isn't taking effect in the database?

logstash-simple.conf:

```auto
input {
	elasticsearch {
		cloud_auth => "my_auth"
			cloud_id => "my_cloud_id"
			index => "logistic_index"
			query => '{ "_source": ["message"], "query": { "query_string": { "query": "\\[ELK\\]", "fields": ["message"] } } }'
	}
}

filter {
	mutate {
		gsub => [
			"message", ",", "",
			"message", "}", "",
			"message", "{", ""
		]
	}
	date {
		match => ["@timestamp", "MMM dd, yyyy @ HH:mm:ss.SSS"]
		target => "@timestamp"
	}
	kv { }
}

output {
	elasticsearch {
		cloud_auth => "my_auth"
			cloud_id => "my_cloud_id"
			index => "logistic_index_new"
	}
}

```

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [August 8, 2024, 5:26pm UTC](https://discuss.elastic.co/t/cant-modify-the-timestamp-field-via-logstash/364009/2 "2024-08-08T17:26:56Z")

</div>

If you change the `target` to another field name like `tmp_timestamp` do you see that field with the correct value in Elasticsearch?

---

<div class="post-metadata">

**Author:** ![Gur-Sin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gur-sin/32/136383_2.png) [@Gur-Sin](https://discuss.elastic.co/u/Gur-Sin)\
**Post date:** [August 16, 2024, 7:03am UTC](https://discuss.elastic.co/t/cant-modify-the-timestamp-field-via-logstash/364009/3 "2024-08-16T07:03:57Z")

</div>

Yes, doing so was possible but since we were migrating indices, such a solution wouldn't suffice.

However, this issue was fixed by making a slight change in the query by deleting the source filter. Thanks for the help!