# Copy another field with nanoseconds to elasticsearch/kibana @timestamp field
**URL:** https://discuss.elastic.co/t/copy-another-field-with-nanoseconds-to-elasticsearch-kibana-timestamp-field/222541
**Category:** Elasticsearch
**Created:** [March 7, 2020, 6:48am UTC](https://discuss.elastic.co/t/copy-another-field-with-nanoseconds-to-elasticsearch-kibana-timestamp-field/222541 "2020-03-07T06:48:11Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@savvy](https://discuss.elastic.co/u/savvy)
#### Post date: [March 7, 2020, 6:48am UTC](https://discuss.elastic.co/t/copy-another-field-with-nanoseconds-to-elasticsearch-kibana-timestamp-field/222541/1 "2020-03-07T06:48:11Z")
Hello,
My Elasticsearch is version 7.5
I have
a\> date type - @timestamp field
b\> string type - event\_timestamp field (format: 2020-03-06 20:28:33:232123456 +0000) sent in each event.
What I want to achieve:
1st, I want to copy @timestamp field to another field called ls\_timestamp (ls\_timestamp should have same format as @timestamp after copying)
2nd, I want to copy event\_timestamp field value to @timestamp (I want to see all the nanoseconds from event\_timestamp in @timestamp after copying)
3rd, I want to delete event\_timestamp field.
Please let me know how I can achieve this. Thanks.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 7, 2020, 8:10am UTC](https://discuss.elastic.co/t/copy-another-field-with-nanoseconds-to-elasticsearch-kibana-timestamp-field/222541/2 "2020-03-07T08:10:02Z")
Have you mapped the field as `date_nanos` in Elasticsearch as described in [this blog post](https://www.elastic.co/blog/journey-support-nanosecond-timestamps-elasticsearch)?
---
### Author:  [@savvy](https://discuss.elastic.co/u/savvy)
#### Post date: [March 9, 2020, 5:13am UTC](https://discuss.elastic.co/t/copy-another-field-with-nanoseconds-to-elasticsearch-kibana-timestamp-field/222541/4 "2020-03-09T05:13:58Z")
Hi @Christian,
I have set the date field format to nanoseconds.
For e.g:
Initial values for:
@timestamp: Mar 9, 2020 @ 00:58:55.528000000
event\_timestamp: 2020-03-09 04:58:54.497305256 +0000
After 1st, 2nd and 3rd above are applied, I see
@timestamp: Mar 9, 2020 @ 00:58:54.497000000
ls\_timestamp: 2020-03-09T04:58:55.528Z
The issue I see is @timestamp is not showing all the nanoseconds as in event\_timestamp.
and ls\_timestamp is showing in UTC even though my original @timestamp is in EST.
Filter used:
mutate
{
add\_field =\> ["ls\_timestamp", "%{@timestamp}"]
}
date {
match =\> ["event\_timestamp" ,"yyyy-MM-dd HH:mm:ss.SSSSSSSSS Z"]
target =\> "@timestamp"
timezone =\> "UTC"
}
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 9, 2020, 6:35am UTC](https://discuss.elastic.co/t/copy-another-field-with-nanoseconds-to-elasticsearch-kibana-timestamp-field/222541/5 "2020-03-09T06:35:18Z")
Elasticsearch requires all timestamps to be stored in UTC and Kibana and other utilities rely on this.
In order for Elasticsearch to be able to handle and interpret nanoesecond precision timestamps you do need the special mapping I linked to. Can you please show us your index template?
As this is a reasonably new feature in Elasticsearch (7.x) I am not sure whether the Logstash date filter has been updated to support this yet or not. It used to only be able to handle the standard millisecond precision if I recall correctly. Maybe someone from the Logstash team can shed some light on this?
---
### Author:  [@savvy](https://discuss.elastic.co/u/savvy)
#### Post date: [March 9, 2020, 5:27pm UTC](https://discuss.elastic.co/t/copy-another-field-with-nanoseconds-to-elasticsearch-kibana-timestamp-field/222541/6 "2020-03-09T17:27:28Z")
Here is my index template:
{
"order": 2,
"index\_patterns": [
"_mydata_"
],
"settings": {},
"mappings": {
"properties": {
"event\_timestamp": {
"type": "date\_nanos"
},
"@timestamp": {
"type": "date\_nanos"
},
"ls\_timestamp": {
"type": "date\_nanos"
}
}
},
"aliases": {}
}
Seeing this messages in LS:
Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"test-mydata-newfeature-weekly-2020.03-11-2", :routing=\>nil, :\_type=\>"\_doc"}, #LogStash::Event:0x7e53f105], :response=\>{"index"=\>{"\_index"=\>"test-mydata-newfeature-weekly-2020.03-11-2", "\_type"=\>"\_doc", "\_id"=\>"EdBSwHABTddalsd96xyO", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [event\_timestamp] of type [date\_nanos] in document with id 'EdBSwHABTddalsd96xyO'. Preview of field's value: '2020-03-09 17:23:05.224925379 +0000'", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"failed to parse date field [2020-03-09 17:23:05.224925379 +0000] with format [strict\_date\_optional\_time||epoch\_millis]", "caused\_by"=\>{"type"=\>"date\_time\_parse\_exception", "reason"=\>"date\_time\_parse\_exception: Failed to parse with all enclosed parsers"}}}}}}
---
### Author:  [@savvy](https://discuss.elastic.co/u/savvy)
#### Post date: [March 9, 2020, 7:44pm UTC](https://discuss.elastic.co/t/copy-another-field-with-nanoseconds-to-elasticsearch-kibana-timestamp-field/222541/7 "2020-03-09T19:44:04Z")
I have been playing around with this. This is my latest updated index template:
{
"order": 2,
"index\_patterns": [
"mydata"
],
"settings": {},
"mappings": {
"properties": {
"ls\_timestamp": {
"type": "date\_nanos"
},
"@timestamp": {
"type": "date\_nanos"
},
"event\_timestamp": {
"format": "yyyy-MM-dd HH:mm:ss.SSSSSSSSS Z",
"type": "date\_nanos"
}
}
},
"aliases": {}
}
I don't see above "could not index event" message anymore. I can see data in kibana. But still, the nanoseconds are getting chopped off after 3 decimal places after copying event\_timestamp to @timestamp. And event\_timestamp is still coming as string.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 6, 2020, 7:44pm UTC](https://discuss.elastic.co/t/copy-another-field-with-nanoseconds-to-elasticsearch-kibana-timestamp-field/222541/8 "2020-04-06T19:44:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.