# Change default logstash @timestamp with a timestamp from my logs
**URL:** https://discuss.elastic.co/t/change-default-logstash-timestamp-with-a-timestamp-from-my-logs/133717
**Category:** Logstash
**Created:** [May 29, 2018, 4:18pm UTC](https://discuss.elastic.co/t/change-default-logstash-timestamp-with-a-timestamp-from-my-logs/133717 "2018-05-29T16:18:36Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Nithin\_Nk](https://discuss.elastic.co/u/Nithin_Nk)
#### Post date: [May 29, 2018, 4:18pm UTC](https://discuss.elastic.co/t/change-default-logstash-timestamp-with-a-timestamp-from-my-logs/133717/1 "2018-05-29T16:18:37Z")
Hi Have a json log file which looks like:
{"tenant\_id":"e100118","component\_job\_id":56153,"component\_status":"ERROR","system\_id":"GBT204","business\_type":"Test","application\_id":"e100118tmn","error\_since\_dtm":"22-05-2018 15:17:28 UTC"}
I transferred the logs to elasticsearch using logstash and i am able to see the data. But since I am doing a one time upload, the timestamp created is the logstash timestamp which show the time when I do the upload. But I need it to look like the data is uploaded with the timestamp in my log file.
For example :
when i upload the data, index is created with a value @timestamp : todays date....
but i need to replace this @timestamp with the time of error\_since\_dtm....
Is that possible?
---
### Author:  [@Nithin\_Nk](https://discuss.elastic.co/u/Nithin_Nk)
#### Post date: [May 29, 2018, 4:20pm UTC](https://discuss.elastic.co/t/change-default-logstash-timestamp-with-a-timestamp-from-my-logs/133717/2 "2018-05-29T16:20:33Z")
This is how config file looks like
Input
input {
file {
path =\> "/opt/json/file.json"
type =\> "json" # a type to identify those logs (will need this later)
start\_position =\> "beginning"
sincedb\_path =\> "/dev/null"
exclude =\> "\*.gz"
}
}
filter :
filter{
json{
source =\> "message"
}
date {
```
locale => "en"
match => ["error_since_dtm","dd-MM-YYYY HH:mm:ss"]
timezone => "UTC"
"target" => "@timestamp"
}
```
}
output
output
{
elasticsearch {
codec =\> json
hosts =\> ["10.47.43.67:9200"]
index =\> "pkpkpkjson"
}
```
stdout { codec => rubydebug }
```
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 29, 2018, 4:28pm UTC](https://discuss.elastic.co/t/change-default-logstash-timestamp-with-a-timestamp-from-my-logs/133717/3 "2018-05-29T16:28:47Z")
> [@Nithin\_Nk](#):
>
> match =\> ["error\_since\_dtm","dd-MM-YYYY HH:mm:ss"]
error\_since\_dtm has a timezone on it, so this should be
```
match => ["error_since_dtm","dd-MM-YYYY HH:mm:ss ZZZ"]
```
You have to match the whole field.
---
### Author:  [@Nithin\_Nk](https://discuss.elastic.co/u/Nithin_Nk)
#### Post date: [May 29, 2018, 4:52pm UTC](https://discuss.elastic.co/t/change-default-logstash-timestamp-with-a-timestamp-from-my-logs/133717/4 "2018-05-29T16:52:59Z")
> [@Nithin\_Nk](#):
>
> json{
> source =\> "message"
> }
Super..it worked...I missed it ☹
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 26, 2018, 4:53pm UTC](https://discuss.elastic.co/t/change-default-logstash-timestamp-with-a-timestamp-from-my-logs/133717/5 "2018-06-26T16:53:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.