# Change @Timestamp to date from API response

**URL:** https://discuss.elastic.co/t/change-timestamp-to-date-from-api-response/325369
**Category:** Logstash
**Created:** [February 13, 2023, 9:46am UTC](https://discuss.elastic.co/t/change-timestamp-to-date-from-api-response/325369 "2023-02-13T09:46:14Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Renat](https://avatars.discourse-cdn.com/v4/letter/r/bcef8e/32.png) [@Renat](https://discuss.elastic.co/u/Renat)
#### Post date: [February 13, 2023, 9:46am UTC](https://discuss.elastic.co/t/change-timestamp-to-date-from-api-response/325369/1 "2023-02-13T09:46:14Z")

</div>

Hello everyone,  
first of all i'm sorry if this common issue, but i really tried to solve it by myself.  
but searching in web didn't help me, may be because i never used Logstash.  
So i got request to receive "slowQuery" data from Mongodb OPS Manager Api and load them to Elasticsearch.  
So at this moment it's work somehow and it quite enough for me, except one thing.  
I can't use my api response date instead @timestamp in ELK, it's always put date of loading data to ELK.  
I tried to use different ways with filter and date but still nothing  
When i use browser to get method from api, response looks like:  
_\> {"slowQueries":[{"line":"{"t":{"$date":"2023-02-09T19:18:06.568+06:00"},"s":"I", "c":"COMMAND", "id":51803, "ctx":"conn1161110","msg":"Slow query","attr":{"type":"command","ns":"harvester.ZabbixNew","command":{"getMore":4341464678045031103,"collection":"ZabbixNew","lsid":{"id"........_

This is my conf file:

```plaintext
    urls => {
       Harvester => {
        url => "api url"
        headers => {
          Accept => "application/json"
       }
        auth => {
          user => "user"
          password => "pass"
      }
     }

    }
    request_timeout => 60
    schedule => { every => "200s"}
   
    codec => "json"
    type => "json"
   
  }
}

filter {
json {
    source => "message"
}
 split {
    field => "[slowQueries]"

 }
mutate {
    remove_field => ["[event][original]"]
 }

date {
    match => ["[slowQueries][line][t]", "ISO8601" ]
    target => @Timestamp
 }
}

output {
elasticsearch {
    hosts => servers
    index => "logstash-mongodb-ops-manager-slow"
    user => "user"
    password => "pass"

}
stdout{codec => rubydebug }
}

```

and this how it' looks in Elastic

 ![slow](https://us1.discourse-cdn.com/elastic/original/3X/5/6/56aeb22fb3c2c6b20c6a3e9cf9347b10a2a7d0ee.jpeg)

Will be appreciate for any help.  
Thank you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 13, 2023, 9:46am UTC](https://discuss.elastic.co/t/change-timestamp-to-date-from-api-response/325369/2 "2023-03-13T09:46:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.