# Date-filter - Issue with setting @timestamp with the value from my log
**URL:** https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433
**Category:** Logstash
**Created:** [May 2, 2019, 8:23pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433 "2019-05-02T20:23:32Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)
#### Post date: [May 2, 2019, 8:23pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433/1 "2019-05-02T20:23:32Z")
Hi Lads,
First of all i'm a newbie here.........
I was trying to format below log entry
`2019-04-29 12:47:46.679.9882 - log message "blah blah blah"`
i was testing it with below stdin
```
input {
stdin { }
}
filter {
grok {
match => { "message" => "%{NOTSPACE}%{TIMESTAMP_ISO8601:logdate}%{GREEDYDATA:msg}" }
}
date {
#match => ["logdate", "ISO8601"]
match => ["logdate", "yy-MM-dd HH:mm:ss.SSS", "ISO8601"]
}
}
output {
stdout { codec => rubydebug }
}
```
However, when I pass my log entry the output I get is as below
```
^X2019-04-29 12:47:46.679.9882 - log message "blah blah blah"
#Yup there is this weird first charactor in my log, so im escaping it with a "%{NOTSPACE}"
{
"host" => "thanu00-elk7-01",
"@version" => "1",
"message" => "\u00182019-04-29 12:47:46.679.9882 - log message \"blah blah blah\"",
"@timestamp" => 2019-04-29T18:47:46.679Z,
"msg" => ".9882 - log message \"blah blah blah\"",
"logdate" => "19-04-29 12:47:46.679"
}
```
As you can see above, almost everything are correct on @timestamp
except the hours there
it suppose to be 12 instead of 18
in logentry timestamp is
"logdate" =\> "19-04-29 12:47:46.679"
but in @timestamp
"@timestamp" =\> 2019-04-29T18:47:46.679Z,
what am i doing wrong here,
I just need to have the timestamp from the log to be pushed out to ES....
Thanks a bunch in advance
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 2, 2019, 8:54pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433/2 "2019-05-02T20:54:20Z")
elasticsearch stores timestamps as UTC. If you are in the US/Central timezone then it assumes your logs are too and adds 6 hours to get them to UTC. If your logs are already in UTC you can add a timezone option to the date filter to tell it that.
---
### Author:  [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)
#### Post date: [May 2, 2019, 9:03pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433/3 "2019-05-02T21:03:51Z")
@Badger
i added the timezone as below
```
input {
stdin { }
}
filter {
grok {
match => { "message" => "%{NOTSPACE}%{TIMESTAMP_ISO8601:logdate}%{GREEDYDATA:msg}" }
}
date {
timezone => "America/Edmonton"
match => ["logdate", "YYYY-MM-dd HH:mm:ss.SSS", "ISO8601"]
}
}
output {
stdout { codec => rubydebug }
}
```
Still its not doing it right...
```
^X2019-04-29 12:47:46.679.9882 - log message "blah blah blah"
{
"logdate" => "19-04-29 12:47:46.679",
"host" => "thanu00-elk7-01",
"message" => "^X2019-04-29 12:47:46.679.9882 - log message \"blah blah blah\"",
"msg" => ".9882 - log message \"blah blah blah\"",
"@version" => "1",
"@timestamp" => 0019-04-29T20:21:38.679Z
}
```
I'm in Calgary/Edmonton timezone..
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [May 2, 2019, 9:06pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433/4 "2019-05-02T21:06:38Z")
I was so confuse on date thing here is thread, and Badger help me understand it
> [@Date to CST](https://discuss.elastic.co/t/date-to-cst/169615/3):
>
> I just want to keep what ever the time it is. what is it converting ot [root@test1]# echo "04-12-2018 11:45:17" | /usr/share/logstash/bin/logstash -f test.conf { "@version" =\> "1", "completed" =\> 2018-12-04T17:45:17.000Z, "message" =\> "04-12-2018 11:45:17", "@timestamp" =\> 2019-02-22T17:44:23.267Z, } Difference is +6 if I do etc/GMT-6 = 2018-12-04T05:45:17.000Z, ( 6 hour behind.) I simply just want to keep whatever this time is. I am in "America/Chicago" timezone.
[https://discuss.elastic.co/t/date-to-cst/169615/3](https://discuss.elastic.co/t/date-to-cst/169615/3)
---
### Author:  [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)
#### Post date: [May 2, 2019, 9:20pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433/5 "2019-05-02T21:20:56Z")
Basically, eventho it shows the mytime +6 hours in my case, when it renders in Kibana or something it will show up in correct time ??
@elasticforme @Badger ^^^ ??
---
### Author:  [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)
#### Post date: [May 2, 2019, 9:48pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433/6 "2019-05-02T21:48:55Z")
@Badger @elasticforme
Is this error familiar to you ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 2, 2019, 10:30pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433/7 "2019-05-02T22:30:42Z")
> [@Thanura\_Kannangara](#):
>
> match =\> ["logdate", "YYYY-MM-dd HH:mm:ss.SSS", "ISO8601"]
Replace YYYY with YY
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 2, 2019, 10:31pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433/8 "2019-05-02T22:31:11Z")
> [@Thanura\_Kannangara](#):
>
> Basically, eventho it shows the mytime +6 hours in my case, when it renders in Kibana or something it will show up in correct time ??
Yes, by default Kibana renders in the browser's timezone.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 2, 2019, 10:32pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433/9 "2019-05-02T22:32:34Z")
Please do not post pictures of text, just post the text. I am not familiar with that error.
---
### Author:  [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)
#### Post date: [May 2, 2019, 10:42pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433/10 "2019-05-02T22:42:48Z")
Thanks @Badger @elasticforme
got it resolved , This is all i needed....
```
grok {
match => {
"message" =>
"%{NOTSPACE}%{TIMESTAMP_ISO8601:logdate}%{NOTSPACE}%{GREEDYDATA:msg}"
}
}
date {
match => ["logdate", "yy-MM-dd HH:mm:ss.SSS", "ISO8601"]
}
```
Thanks a lot for your prompt replies
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 30, 2019, 10:42pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433/11 "2019-05-30T22:42:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.