# Change timestamp in logstash **URL:** \ **Category:** Logstash\ **Created:** [March 7, 2024, 6:43am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909 "2024-03-07T06:43:00Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![sudharsanam132](https://avatars.discourse-cdn.com/v4/letter/s/97f17d/32.png) [@sudharsanam132](https://discuss.elastic.co/u/sudharsanam132)\ **Post date:** [March 7, 2024, 6:43am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909/1 "2024-03-07T06:43:00Z")
Im having logs like below from logstash 8.9.1 ```auto 2024-03-06T23:43:37.317829530Z 192.168.1.132 <14> 2024-03-06T23:43:37Z forwarder.tmes.trendmicro.com tmes[1]: CEF:0|Trend Micro|TMES|1.0.0.0|100101|DETECTION|6|rt=2024-03-06T23:43:12.149Z ``` how to change the first timestamp to other local timezone? ---
**Author:** ![sudharsanam132](https://avatars.discourse-cdn.com/v4/letter/s/97f17d/32.png) [@sudharsanam132](https://discuss.elastic.co/u/sudharsanam132)\ **Post date:** [March 7, 2024, 8:06am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909/2 "2024-03-07T08:06:50Z")
Is it possible ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [March 7, 2024, 8:48am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909/3 "2024-03-07T08:48:36Z")
Yes it's possible. Parse with grok/dissect then use the date plugin. ``` date { match => ["timestamp", "ISO8601"] timezone => "Asia/Dubai" # set your own accoding to Joda time https://joda-time.sourceforge.net/timezones.html target=> "@timestamp" # or any other field } ``` ---
**Author:** ![sudharsanam132](https://avatars.discourse-cdn.com/v4/letter/s/97f17d/32.png) [@sudharsanam132](https://discuss.elastic.co/u/sudharsanam132)\ **Post date:** [March 7, 2024, 8:59am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909/4 "2024-03-07T08:59:53Z")
The first timestamp is the field produced after the logs saved in the file so will the grok works on it? ---
**Author:** ![sudharsanam132](https://avatars.discourse-cdn.com/v4/letter/s/97f17d/32.png) [@sudharsanam132](https://discuss.elastic.co/u/sudharsanam132)\ **Post date:** [March 7, 2024, 9:02am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909/5 "2024-03-07T09:02:29Z")
The first timestamp is the field produced after the logs saved in the file so will the grok works on it? For example my log is `hello` output will be like `{Timestamp} {host ip} {hello}` So how the grok look upon it ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [March 7, 2024, 9:11am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909/6 "2024-03-07T09:11:13Z")
`%{TIMESTAMP_ISO8601:timestamp} %{IPORHOST:ip} %{GREEDYDATA:msg}` That will produce: | timestamp | 2024-03-06T23:43:37.317829530Z | | --- | --- | | ip | 192.168.1.132 | | msg | \<14\>·2024-03-06T23:43:37Z·[forwarder.tmes.trendmicro.com](http://forwarder.tmes.trendmicro.com)·tmes[1]:·CEF:0 | ---
**Author:** ![sudharsanam132](https://avatars.discourse-cdn.com/v4/letter/s/97f17d/32.png) [@sudharsanam132](https://discuss.elastic.co/u/sudharsanam132)\ **Post date:** [March 7, 2024, 10:02am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909/8 "2024-03-07T10:02:43Z")
SO the configuration only works if there is time stamp available in log is there any other way to add the timestamp +5:30 hours for it ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [March 7, 2024, 10:54am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909/9 "2024-03-07T10:54:26Z")
If not receive time as @timestamp as a field, LS will take the host local time for @timestamp. Since you are receiving as a part of log messages, you will parse and with the date plugin you will overwrite @timestamp with the log time. Like above. If you not receive as the part of message or you don't want to use then set @timestamp to another time zone or hardcoded TZ- actually offset, like you suggested +5:30. Be aware, the hard coded value doesn't take in account daylight saving time. ```auto if ![timestamp] { # if timestamp field does not exist mutate { # maybe you will need to convert string convert => { "@timestamp" => "string"} } date { match => ["@timestamp", "ISO8601"] timezone => "Asia/Dubai" } } ``` ---
**Author:** ![sudharsanam132](https://avatars.discourse-cdn.com/v4/letter/s/97f17d/32.png) [@sudharsanam132](https://discuss.elastic.co/u/sudharsanam132)\ **Post date:** [March 7, 2024, 11:33am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909/10 "2024-03-07T11:33:55Z")
The +5:30 is ok for us beacause those logs moved for just test monitoring backup purpose which plugin will be used for this ? ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [March 8, 2024, 8:47am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909/12 "2024-03-08T08:47:39Z")
Date offset +5:30 will be used for all events/messages if the timestamp field doesn't exist. If you more granular add one or a few more IFs. ---
**Author:** ![sudharsanam132](https://avatars.discourse-cdn.com/v4/letter/s/97f17d/32.png) [@sudharsanam132](https://discuss.elastic.co/u/sudharsanam132)\ **Post date:** [March 8, 2024, 9:04am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909/13 "2024-03-08T09:04:53Z")
This is my log now pushing to another server ```auto 2024-03-08T08:51:37.382895768Z 2.10.14.14 <14> 2024-03-08T08:51:37Z forwarder.tmes.trendmicro.com tmes[1]: CEF:0|Trend Micro|TMES|1.0.0.0|100101|DETECTION|6|rt=2024-03-08T08:50:58.248Z cs1Label=eventType cs1=scan_limitation cs2Label=domainName cs2=ll.com suser=rll.com duser=llk.com cs3Label=direction cs3=incoming cs4Label=messageId cs4= msg=Adangal - 07-Mar-2024, 16:49 cn1Label=messageSize cn1=908230 cs5Label=policyName cs5=CFE2022:IVP: Virus_Policy act=Bypass cs6Label=details cs6={}` ``` I Want the first timestamp to add +5:30 hours thats my case my grok is ```auto filter { grok { match => { "message" => "%{TIMESTAMP_ISO8601:timestamp1} %{DATA} %{TIMESTAMP_ISO8601:timestamp2} %{GREEDYDATA:program}" } } ``` I tried with date and ruby not works for me ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 5, 2024, 9:05am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909/14 "2024-04-05T09:05:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.