# Changing a term in a json to become the timestamp from filebeat

**URL:** <https://discuss.elastic.co/t/changing-a-term-in-a-json-to-become-the-timestamp-from-filebeat/75907>\
**Category:** Logstash\
**Created:** [February 21, 2017, 3:52pm UTC](https://discuss.elastic.co/t/changing-a-term-in-a-json-to-become-the-timestamp-from-filebeat/75907 "2017-02-21T15:52:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)\
**Post date:** [February 21, 2017, 3:52pm UTC](https://discuss.elastic.co/t/changing-a-term-in-a-json-to-become-the-timestamp-from-filebeat/75907/1 "2017-02-21T15:52:10Z")

</div>

Hi,

My Filebeat is reading the time that the a log file is created as the timestamp. This is a problem since it does not read every message in the log with a unique time.  
What I am trying to do is to parse a json that one of its terms will become the timestamp, that I will be able to get correct graphs.

Here is an example of such a json

{  
"msg": "Hello",  
"msgSubmissionTime": "1484752676968"  
}

Many Thanks for any one who can help

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 22, 2017, 4:39am UTC](https://discuss.elastic.co/t/changing-a-term-in-a-json-to-become-the-timestamp-from-filebeat/75907/2 "2017-02-22T04:39:14Z")

</div>

You can use Filebeat to parse the JSON event. See the [json](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#config-json) docs.

And then in either [Logstash](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) or Elasticsearch (using Ingest Node) you can parse `msgSubmissionTime` using a [date processor](https://www.elastic.co/guide/en/elasticsearch/reference/master/date-processor.html). From there you can either leave it as msgSubmissionTime in the event or overwrite the @timestamp field with the parsed value.

---

<div class="post-metadata">

**Author:** ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)\
**Post date:** [February 23, 2017, 7:38am UTC](https://discuss.elastic.co/t/changing-a-term-in-a-json-to-become-the-timestamp-from-filebeat/75907/3 "2017-02-23T07:38:18Z")

</div>

Thanks, @andrewkroh!

Is there a way to do so without logstash? Is there a way to do this configuration through Kibana or FileBeat?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [February 24, 2017, 11:53am UTC](https://discuss.elastic.co/t/changing-a-term-in-a-json-to-become-the-timestamp-from-filebeat/75907/4 "2017-02-24T11:53:08Z")

</div>

As Andrew described, it can also be done with ingest, so you don't need Logstash. Configuration must be done directly in Elasticsearch.

---

<div class="post-metadata">

**Author:** ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)\
**Post date:** [March 5, 2017, 8:49am UTC](https://discuss.elastic.co/t/changing-a-term-in-a-json-to-become-the-timestamp-from-filebeat/75907/5 "2017-03-05T08:49:26Z")

</div>

Hi @andrewkroh and @ruflin,

Thanks for the help until now!

I installed Logstash and configured it to all the rest of ELK. I am trying to use Grok to make that msgSubmissionTime will become the timeStamp. This looks like a simple procedure but I am pretty confused from the documentation. I will be happy if you can help!

msgSubmissionTime is given as milliseconds and not on all the incoming Jsons get msgSubmissionTime.  
If the fact that on some Jsons I get this Field and some I don't will be a issue I can change this.

I tried:

```
filter {
  date {
match => ["msgSubmissionTime", "SSS"]
  }
}

```

I also tried:

```
filter {
  mutate {
    convert => {"msgSubmissionTime"=> "integer" }
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2017, 8:49am UTC](https://discuss.elastic.co/t/changing-a-term-in-a-json-to-become-the-timestamp-from-filebeat/75907/6 "2017-04-02T08:49:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.