# Date difference in events received from filebeat

**URL:** https://discuss.elastic.co/t/date-difference-in-events-received-from-filebeat/166866
**Category:** Logstash
**Created:** [February 3, 2019, 1:48pm UTC](https://discuss.elastic.co/t/date-difference-in-events-received-from-filebeat/166866 "2019-02-03T13:48:28Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![skarcos](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@skarcos](https://discuss.elastic.co/u/skarcos)
#### Post date: [February 3, 2019, 1:48pm UTC](https://discuss.elastic.co/t/date-difference-in-events-received-from-filebeat/166866/1 "2019-02-03T13:48:28Z")

</div>

Hello,

I am using filebeat on a remote linux machine to send events to logstash.

I am using grok and the date module to get events' timestamps.

Here is my complete configuration:

```
input {
  beats {
    type => "gemma_logs"
    port => 5045
  }
}

filter{
  if [type] == "gemma_logs" {
    grok {
      match => ["message" , "%{TIMESTAMP_ISO8601:logdate} %{DATA:level} \[%{DATA:class}\] \(%{DATA:file}:%{NUMBER:line}\) - %{GREEDYDATA:log_message}"]
    }
    date {
      match => ["logdate", "YYYY-mm-dd HH:mm:ss,SSS"]
    }
  }
}

output {
  if [type] == "gemma_logs" {
    elasticsearch {
      hosts => "localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    }
  }
}

```

This worked fine until January 31st 23:59:59 (?!). However, no index has been created for February until now (the 3rd). In the logstash debug logs I see that there is a strange time difference now between events and their matched timestamp; it is exactly 2 hours to a month:

Here is an example:

```
"message"=>"2019-02-03 14:24:59,147 DEBUG [cti.cdr.CdrLogger] 
"logdate"=>"2019-02-03 14:24:59,147",
"@timestamp"=>2019-01-03T12:24:59.147Z       

```

Here is the complete event from filebeat:

```
[2019-02-03T14:25:04,547][DEBUG][logstash.pipeline] output received 
	{"event"=> {"source"=>"/var/log/gemma/telephonyserver.log",
				"offset"=>17777708,
				"prospector"=>{"type"=>"log"},
				"host"=>{"os"=>{"family"=>"debian",
								"platform"=>"debian",
								"version"=>"9 (stretch)",
								"codename"=>"stretch"},
						"id"=>"f4b257800bf84bb185af2518df28f267",
						"name"=>"gemmasrv",
						"containerized"=>false,
						"architecture"=>"x86_64"},
				"@version"=>"1",
				"file"=>"CdrLogger.java",
				"beat"=>{"hostname"=>"gemmasrv",
						"name"=>"gemma_10.0.26.20",
						"version"=>"6.5.4"},
				"class"=>"cti.cdr.CdrLogger",
				"type"=>"gemma_logs",
				"log_message"=>"deliveredEvent(device: 302106960115)",
				"line"=>"139",
				"logdate"=>"2019-02-03 14:24:59,147",
				"input"=>{"type"=>"log"},
				"tags"=>["beats_input_codec_plain_applied"],
				"level"=>"DEBUG",
				"message"=>"2019-02-03 14:24:59,147 DEBUG [cti.cdr.CdrLogger] (CdrLogger.java:139) - deliveredEvent(device: 302106960115)",
				"@timestamp"=>2019-01-03T12:24:59.147Z}
				}

```

I'll appreciate any help or ideas.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 3, 2019, 2:08pm UTC](https://discuss.elastic.co/t/date-difference-in-events-received-from-filebeat/166866/2 "2019-02-03T14:08:33Z")

</div>

> [@skarcos](#):
>
> date { match =\> ["logdate", "YYYY-mm-dd HH:mm:ss,SSS"] }

Change YYYY-mm-dd to YYYY-MM-dd

---

<div class="post-metadata">

### Author: ![skarcos](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@skarcos](https://discuss.elastic.co/u/skarcos)
#### Post date: [February 3, 2019, 7:26pm UTC](https://discuss.elastic.co/t/date-difference-in-events-received-from-filebeat/166866/3 "2019-02-03T19:26:51Z")

</div>

That worked. Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 3, 2019, 7:27pm UTC](https://discuss.elastic.co/t/date-difference-in-events-received-from-filebeat/166866/4 "2019-03-03T19:27:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.