# Displaying @datetime in UTC format from Elasticsearch database rollup using Kibana **URL:** \ **Category:** Kibana\ **Created:** [August 7, 2019, 4:36pm UTC](https://discuss.elastic.co/t/displaying-datetime-in-utc-format-from-elasticsearch-database-rollup-using-kibana/194289 "2019-08-07T16:36:29Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![EricJohnson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericjohnson/32/53592_2.png) [@EricJohnson](https://discuss.elastic.co/u/EricJohnson)\ **Post date:** [August 7, 2019, 4:36pm UTC](https://discuss.elastic.co/t/displaying-datetime-in-utc-format-from-elasticsearch-database-rollup-using-kibana/194289/1 "2019-08-07T16:36:29Z")
Greetings! We are using Elasticsearch rollups of metricbeat data using Kibana. Instead of @datetime we would like to see the date in UTC. I cannot find an option to do this in Kibana. We just need to convert the field "@timestamp.date\_histogram.timestamp" in UTC format. I.e., we want '07-23-2019T19:34:00.000000' rather than '1563910440000'. Any suggestions will be greatly appreciated. I tried to modify the JSON configuration directly but Kibana will not allow it. This is the JSON configuration file for the rollup: { "config": { "id": "cpu\_daily\_rollup", "index\_pattern": "metricbeat-\*", "rollup\_index": "cpu\_daily", "cron": "0 0 0 \* \* ?", "groups": { "date\_histogram": { "fixed\_interval": "24h", "field": "@timestamp", "delay": "30m", "time\_zone": "UTC" }, "histogram": { "interval": 5, "fields": [ "system.cpu.total.pct" ] }, "terms": { "fields": [ "system.cpu.total.pct", "fields.oss.id", "system.cpu.cores" ] } }, "metrics": [ { "field": "system.cpu.total.pct", "metrics": [ "avg", "max", "value\_count", "sum", "min" ] }, { "field": "@timestamp", "metrics": [ "value\_count" ] } ], "timeout": "20s", "page\_size": 1000 }, "status": { "job\_state": "started", "current\_position": { "@timestamp.date\_histogram": 1564963200000, "fields.oss.id.terms": "5a4fe62140a7078a7930ceac", "system.cpu.cores.terms": 2, "system.cpu.total.pct.histogram": 0, "system.cpu.total.pct.terms": 1.948 }, "upgraded\_doc\_id": true }, "stats": { "pages\_processed": 17, "documents\_processed": 5424850, "rollups\_indexed": 15490, "trigger\_count": 1, "index\_time\_in\_ms": 4725, "index\_total": 16, "index\_failures": 0, "search\_time\_in\_ms": 47329, "search\_total": 17, "search\_failures": 0 } } ![UTC](https://us1.discourse-cdn.com/elastic/original/3X/d/a/da029a2f9f439bef0c490d9453997680123e4665.png) Thank you! ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [August 8, 2019, 10:31am UTC](https://discuss.elastic.co/t/displaying-datetime-in-utc-format-from-elasticsearch-database-rollup-using-kibana/194289/2 "2019-08-08T10:31:08Z")
Hi @EricJohnson your rollup config is looking fine. It is normal that the date fields are saved as timestamps in Elasticsearch, but Kibana should definitely format them correctly. Where exactly in Kibana do you see the raw timestamps? Does the field have the right type in the index pattern? ---
**Author:** ![EricJohnson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericjohnson/32/53592_2.png) [@EricJohnson](https://discuss.elastic.co/u/EricJohnson)\ **Post date:** [August 8, 2019, 2:53pm UTC](https://discuss.elastic.co/t/displaying-datetime-in-utc-format-from-elasticsearch-database-rollup-using-kibana/194289/3 "2019-08-08T14:53:43Z")
Thank you for the reply! We see raw timestamps if we select the timestamp field in the rollup while looking at the "Discover" tab in Kibana. These "@timestamp.date\_histogram.timestamp" fields are in the "1564963200000" format that we want to see as UTC. There is not, as far as I can see, any option to view them in the format we need. ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [August 8, 2019, 2:56pm UTC](https://discuss.elastic.co/t/displaying-datetime-in-utc-format-from-elasticsearch-database-rollup-using-kibana/194289/4 "2019-08-08T14:56:29Z")
If you go to Management \> Index Patterns \> `` what type does the `@timestamp.date_histogram.timestamp` field have? If it doesn't have a date type that could be the problem. ---
**Author:** ![EricJohnson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericjohnson/32/53592_2.png) [@EricJohnson](https://discuss.elastic.co/u/EricJohnson)\ **Post date:** [August 8, 2019, 3:01pm UTC](https://discuss.elastic.co/t/displaying-datetime-in-utc-format-from-elasticsearch-database-rollup-using-kibana/194289/5 "2019-08-08T15:01:22Z")
It has "date" as expected. ![date](https://us1.discourse-cdn.com/elastic/original/3X/d/a/da36f3214222d97978f8d42bed2417d263f01a71.png) ---
**Author:** ![EricJohnson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericjohnson/32/53592_2.png) [@EricJohnson](https://discuss.elastic.co/u/EricJohnson)\ **Post date:** [August 8, 2019, 3:14pm UTC](https://discuss.elastic.co/t/displaying-datetime-in-utc-format-from-elasticsearch-database-rollup-using-kibana/194289/6 "2019-08-08T15:14:48Z")
Nothing changes if I go to "Edit" and change the Date format to "MMM D, YYYY @ HH:mm:ss:SSS". It still just shows up as a long number. ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [August 8, 2019, 3:25pm UTC](https://discuss.elastic.co/t/displaying-datetime-in-utc-format-from-elasticsearch-database-rollup-using-kibana/194289/7 "2019-08-08T15:25:43Z")
Ah, sorry, I forgot - You cannot view rollup indices in Discover because discover is a tool to view individual documents. In rollup indices the original documents are not present anymore. If you want to see the count of documents over time, you can configure this kind of chart in Visualize based on the rollup index and everything will get formatted correctly. If you absolutely want to look at the the raw rolled up documents, you can create a standard index pattern that matches only the rolled up indices, then the rolled up document groups are shown as individual documents, which is probably more confusing than helpful. It's easier to stick with Visualizations and Dashboard to explore rolled up data. ---
**Author:** ![EricJohnson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericjohnson/32/53592_2.png) [@EricJohnson](https://discuss.elastic.co/u/EricJohnson)\ **Post date:** [August 8, 2019, 3:29pm UTC](https://discuss.elastic.co/t/displaying-datetime-in-utc-format-from-elasticsearch-database-rollup-using-kibana/194289/8 "2019-08-08T15:29:34Z")
Thank you again for looking into this for me. I think that answers the question! Thank you! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 5, 2019, 3:29pm UTC](https://discuss.elastic.co/t/displaying-datetime-in-utc-format-from-elasticsearch-database-rollup-using-kibana/194289/9 "2019-09-05T15:29:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.