# Change timestamp in logstash input

**URL:** <https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506>\
**Category:** Logstash\
**Created:** [November 22, 2022, 3:51am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506 "2022-11-22T03:51:00Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![zerratriani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerratriani/32/113308_2.png) [@zerratriani](https://discuss.elastic.co/u/zerratriani)\
**Post date:** [November 22, 2022, 3:51am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506/1 "2022-11-22T03:51:00Z")

</div>

Hi, I have a log like this and want to change the timestamp to the time in the log.

Example Log

```auto
event1: aaaaaaa | event2: xxxxxxx | event3: ccccccc | date : 2022-11-07T21:03:48.9110;

```

The logstash

```auto
input {
  file {
    path => "D:/dump/*.log"
    start_position => "beginning"
    mode => "read"
    file_completed_action => "delete"
    sincedb_path => "NUL"
  }
}

filter {
    grok {
	  break_on_match => false
	  match => { "rawMessage" => [
			      "(?<Event1>(event1:)([^|]*))",
				  "(?<Event2>(event2:)([^|]*))",
				  "(?<Event3>(event3:)([^|]*))",
				  "(?<date>(date.:)([^;]*))"] }
    }

   date {
			match => "%{date}"
			target => "@timestamp" 
		}
}

output {
		elasticsearch { 
			hosts => ["localhost:9200"]
			index => "event_test"
		}
}

```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 22, 2022, 9:51am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506/2 "2022-11-22T09:51:09Z")

</div>

Try with this:

```auto
	 date {
      match => ["date", "ISO8601"]
	  target=> "@timestamp"
	 }

```

PS. Since this is separated with |, you can use csv or dissect filters.

---

<div class="post-metadata">

**Author:** ![zerratriani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerratriani/32/113308_2.png) [@zerratriani](https://discuss.elastic.co/u/zerratriani)\
**Post date:** [November 22, 2022, 10:39am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506/3 "2022-11-22T10:39:24Z")

</div>

> [@Rios](#):
>
> ```auto
> date {
> match => ["date", "ISO8601"]
> target=> "@timestamp"
> }
> 
> ```

It still gives results like the following. Log stays in time when sent.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/7/978f2a301b13a1a16e13519ed18c1ac0794a051a.png)

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 22, 2022, 2:18pm UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506/4 "2022-11-22T14:18:14Z")

</div>

Your grok is not OK. The date field has value:

```auto
{
  "date": [
    [
      "date : 2022-11-07T21:03:48.9110"
    ]
  ]

```

Try something like this:

```auto
grok {
	  match => { "rawMessage" => "event1: %{DATA:event1} \| event2: %{DATA:event2} \| event3: %{DATA:event3} \| date : %{DATA:date};"
}
	 date {
      match => ["date", "ISO8601"]
	  target=> "@timestamp"
	 }

```

---

<div class="post-metadata">

**Author:** ![zerratriani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerratriani/32/113308_2.png) [@zerratriani](https://discuss.elastic.co/u/zerratriani)\
**Post date:** [November 23, 2022, 8:42am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506/5 "2022-11-23T08:42:54Z")

</div>

It works now then how do I change the timezone in my area? Because it's still using global time. Thank you

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 23, 2022, 9:21am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506/6 "2022-11-23T09:21:59Z")

</div>

Time zones are [here](https://joda-time.sourceforge.net/timezones.html)  
ES and LS are based on UTC. Bu default, Kibana show data based on browser TimeZone.

```auto
  date {
      match => ["date", "ISO8601"]
      timezone => "Asia/Bangkok"
      target=> "@timestamp"
  }

```

---

<div class="post-metadata">

**Author:** ![zerratriani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerratriani/32/113308_2.png) [@zerratriani](https://discuss.elastic.co/u/zerratriani)\
**Post date:** [November 28, 2022, 4:24am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506/7 "2022-11-28T04:24:34Z")

</div>

Hi, i have problem with date filter, i run it on windows and it's work perfectly. But when i try in linux environtment it's doesn't work. And doesn't send any data to elastic. Please help

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 28, 2022, 6:31am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506/8 "2022-11-28T06:31:29Z")

</div>

Can you dump data from ruby debug on Linux? Put as text, not as pic.

---

<div class="post-metadata">

**Author:** ![zerratriani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerratriani/32/113308_2.png) [@zerratriani](https://discuss.elastic.co/u/zerratriani)\
**Post date:** [November 29, 2022, 8:21am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506/9 "2022-11-29T08:21:49Z")

</div>

it's working now i change

> match =\> ["date", "ISO8601"]  
> to  
> match =\> ["date", "yyyy-MM-dd'T'HH:mm:ss.SSSS"]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 27, 2022, 8:21am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash-input/319506/10 "2022-12-27T08:21:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.