# \_dateparsefailure when trying to overwrite @timestamp
**URL:** https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814
**Category:** Logstash
**Created:** [June 4, 2024, 10:15pm UTC](https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814 "2024-06-04T22:15:33Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Cara410](https://discuss.elastic.co/u/Cara410)
#### Post date: [June 4, 2024, 10:15pm UTC](https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814/1 "2024-06-04T22:15:33Z")
Hello,
I have been trying to get the timestamp to match the log entry and not the time it was ingested. I am using logstash 8.12.2 My log lines look like this:
```auto
{"Timestamp":"2024-06-03 20:18:59.2251", "Message":"BLAH"}
```
My logstash looks like this:
```auto
filter {
if "JSON" in [tags] {
grok {
match => {
"message" => [
"^(?m)\{\"Timestamp\"\:\"%{TIMESTAMP_ISO8601:Timestamp}\"\,%{GREEDYDATA:json_data}$"
]
}
}
}
mutate{
gsub => ["json_data", "^", "{"]
}
json {
source => "json_data"
}
mutate{
remove_field => ["message"]
remove_field => ["json_data"]
}
#only the things below are not working
date {
match => ["Timestamp", "ISO8601", "yyyy-MM-dd HH:mm:ss:SSSS", "yyyy-MM-dd HH:mm:ss:SSS"]
target => "@timestamp"
}
}
```
Everything is working except for the date parsing. No matter what I try I keep getting a \_dateparsefailure. Anyone have any ideas why I can not get this to work and how to fix it?
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [June 4, 2024, 10:45pm UTC](https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814/2 "2024-06-04T22:45:49Z")
> [@Cara410](#):
>
> `"Timestamp":"2024-06-03 20:18:59.2251"`
Should be:
```auto
date {
match => ["Timestamp","yyyy-MM-dd HH:mm:ss.SSSS"]
}
```
---
### Author:  [@Cara410](https://discuss.elastic.co/u/Cara410)
#### Post date: [June 4, 2024, 10:54pm UTC](https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814/3 "2024-06-04T22:54:26Z")
I tried that... and just tried it again and it did not work.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 5, 2024, 3:48am UTC](https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814/4 "2024-06-05T03:48:59Z")
Please share the output you are getting in Logstash.
Also, the log line you share is a `json`, why are you using a grok filter to parse it instead of a json filter?
If you are getting a `_dateparsefailure` it means that the value of in your `Timestamp` field is not matching any of the patterns you specified, you need to share a sample document that is giving you this error and the logstash output you are getting.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [June 5, 2024, 4:54am UTC](https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814/5 "2024-06-05T04:54:27Z")
Can you explain didn't work?
```auto
input {
generator {
message => "BLAH"
count => 1
}
}
filter {
mutate { add_field => { "Timestamp" => "2024-06-03 20:11:59.2251" } }
date { match => ["Timestamp","yyyy-MM-dd HH:mm:ss.SSSS"] }
}
output {
stdout { }
}
```
Output:
```auto
{
"@version" => "1",
"@timestamp" => 2024-06-03T18:11:59.225Z,
"event" => {
"original" => "BLAH",
"sequence" => 0
},
"message" => "BLAH",
"Timestamp" => "2024-06-03 20:11:59.2251"
}
```
You set target: target =\> "@timestamp", I didn't no need, LS is using this field as default, and it always will be in UTC TZ.
You put : before milliseconds instead of . that is why you had \_dateparsefailure
---
### Author:  [@Cara410](https://discuss.elastic.co/u/Cara410)
#### Post date: [June 6, 2024, 9:15pm UTC](https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814/6 "2024-06-06T21:15:32Z")
I guess let me clarify the log line looks more like this:
```auto
{"Timestamp":"2024-06-03 20:18:59.2251", "Message":"LoadNextWindow","Caller":{"Class":"Base","Method":"OpenWindow"},"TypeOfApplication":{"ID":"ID","ApplicationName":"Application"}}
```
Is it possible to still just use the JSON filter? If so I will give that a try. I am not sure how to show the output I am getting without showing information I am unable to show.
---
### Author:  [@Cara410](https://discuss.elastic.co/u/Cara410)
#### Post date: [June 6, 2024, 9:16pm UTC](https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814/7 "2024-06-06T21:16:38Z")
@Rios By didn't work I mean when I tried your suggestion I am still getting a \_dateparsefailure in Kibana.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [June 7, 2024, 5:41am UTC](https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814/8 "2024-06-07T05:41:49Z")
Something not clear here. It's like you are using the JSON codec on events, then you parse by grok. Read what Leandro said, something is not OK with grok parsing.
Can you copy few raw log/event lines which arrive to LS? The event.orginal field or the message field which is not overwritten.
The "message" and "Message" are not the same fields.
---
### Author:  [@Cara410](https://discuss.elastic.co/u/Cara410)
#### Post date: [June 7, 2024, 7:05pm UTC](https://discuss.elastic.co/t/dateparsefailure-when-trying-to-overwrite-timestamp/360814/9 "2024-06-07T19:05:55Z")
I got it working! Thank you my mistake was in matching the timestamp I was using an extra ":" instead of a "."
Thank you for all your help!