# Change timestamp to be timestamp from logfile
**URL:** https://discuss.elastic.co/t/change-timestamp-to-be-timestamp-from-logfile/86993
**Category:** Logstash
**Created:** [May 24, 2017, 2:41pm UTC](https://discuss.elastic.co/t/change-timestamp-to-be-timestamp-from-logfile/86993 "2017-05-24T14:41:15Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@pmohan](https://discuss.elastic.co/u/pmohan)
#### Post date: [May 24, 2017, 2:41pm UTC](https://discuss.elastic.co/t/change-timestamp-to-be-timestamp-from-logfile/86993/1 "2017-05-24T14:41:15Z")
Hi ,
Below is one log time i'm trying to parse via logstash
pvl-api-ft15.sdsdsdasa 2017-05-24 13:45:06,297 INFO http-/0.0.0.0:8080-56 c.s.s.f.s.r.i.RateLimitingRequestFilter RATE\_LIMIT | path /AccountServices/V1/ServiceV1\_9/balance
My match pattern is %{URIHOST:Server} 20%{DATESTAMP:TimeStamp} %{CISCO\_REASON}-%{URIPATHPARAM} %{BASE16FLOAT}%{JAVACLASS}%{BASE16FLOAT}.%{JAVACLASS} RATE\_LIMIT \S+ path %{URIPATH:Servicepath}+%{GREEDYDATA:extra\_fields}
the issue is i want the time stamp to be the time stamp from my logfile and not the time it got parsed into elasticsearch,
date {
match =\> ["TimeStamp" , "yyyy-MM-dd HH:mm:ss,SSS"]
target =\> "@timestamp"
}
I tried the above and didnt work;-(
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 28, 2017, 6:51pm UTC](https://discuss.elastic.co/t/change-timestamp-to-be-timestamp-from-logfile/86993/2 "2017-05-28T18:51:13Z")
There are multiple problems:
- Your grok filter can't possibly work correctly because the DATESTAMP pattern doesn't match YYYY-MM-DD dates. I suggest you use TIMESTAMP\_ISO8601 instead. With your example things happen to work anyway, but that's only because 17 is a valid day and 05 is a valid month.
- You're capturing the timestamp in a way that doesn't include the century, so a yyyy-MM-dd date pattern won't work. yy-MM-dd should be okay though.
If that doesn't help, please show an example event, either as reported by a `stdout { codec => rubydebug }` output or via copy/paste from the JSON tab of Kibana's Discover panel.
---
### Author:  [@pmohan](https://discuss.elastic.co/u/pmohan)
#### Post date: [June 13, 2017, 2:39pm UTC](https://discuss.elastic.co/t/change-timestamp-to-be-timestamp-from-logfile/86993/3 "2017-06-13T14:39:55Z")
Thanks for your reply ! I got it working by doing the below
mutate {
gsub =\> [
# replace all commas with dots
"TimeStamp", ",", "."
]
}
mutate {
gsub =\> [
"TimeStamp", " ", ";"
]
}
date {
locale =\> "en"
match =\> ["TimeStamp", "YYYY-MM-dd;HH:mm:ss.SSS"]
timezone =\> "Europe/London"
target =\> "logTimestamp"
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 11, 2017, 2:40pm UTC](https://discuss.elastic.co/t/change-timestamp-to-be-timestamp-from-logfile/86993/4 "2017-07-11T14:40:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.