# Does grok filter could not change @timestamp?

**URL:** <https://discuss.elastic.co/t/does-grok-filter-could-not-change-timestamp/44688>\
**Category:** Logstash\
**Created:** [March 17, 2016, 10:15am UTC](https://discuss.elastic.co/t/does-grok-filter-could-not-change-timestamp/44688 "2016-03-17T10:15:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![abcfy2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abcfy2/32/453_2.png) [@abcfy2](https://discuss.elastic.co/u/abcfy2)\
**Post date:** [March 17, 2016, 10:15am UTC](https://discuss.elastic.co/t/does-grok-filter-could-not-change-timestamp/44688/1 "2016-03-17T10:15:53Z")

</div>

Here is my config:

```auto
        grok {
            match => { message => 
                "%{TIMESTAMP_ISO8601:@timestamp} %{MONGO3_SEVERITY:severity} %{MONGO3_COMPONENT:component}%{SPACE}(?:\[%{DATA:context}\])? %{GREEDYDATA:content}" 
            }
        }

        if [content] =~ "\d+ms$" {
            grok {
                match => { content =>
                    "%{WORD:command} %{WORD:database}\.(?<object>\S+) (?<slow_query>.+?) %{NUMBER:duration:int}ms"
                }
                add_tag => "slow_query"
                remove_field => "content"
            }
        }

```

I tested with this line:

```auto
2016-03-17T18:03:27.864+0800 I COMMAND [conn2] insert ksRealtimeDB.ks-1622 ninserted:1 keyUpdates:0 writeConflicts:0 numYields:0 locks:{ Global: { acquireCount: { r: 1, w: 1 } }, Database: { acquireCount: { w: 1 } }, Collection: { acquireCount: { w: 1 } } } 1066ms

```

And output:

```auto
{
       "message" => "2016-03-17T18:03:27.864+0800 I COMMAND [conn2] insert ksRealtimeDB.ks-1622 ninserted:1 keyUpdates:0 writeConflicts:0 numYields:0 locks:{ Global: { acquireCount: { r: 1, w: 1 } }, Database: { acquireCount: { w: 1 } }, Collection: { acquireCount: { w: 1 } } } 1066ms",
      "@version" => "1",
    "@timestamp" => "2016-03-17T10:06:25.776Z",
          "type" => "mongodb",
          "host" => "shifudaotest",
      "severity" => "I",
     "component" => "COMMAND",
       "context" => "conn2",
       "command" => "insert",
      "database" => "ksRealtimeDB",
        "object" => "ks-1622",
    "slow_query" => "ninserted:1 keyUpdates:0 writeConflicts:0 numYields:0 locks:{ Global: { acquireCount: { r: 1, w: 1 } }, Database: { acquireCount: { w: 1 } }, Collection: { acquireCount: { w: 1 } } }",
      "duration" => 1066,
          "tags" => [
        [0] "slow_query"
    ]
}

```

The `@timestamp` field does not match the message timestamp. How could I solve this issue?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 17, 2016, 12:04pm UTC](https://discuss.elastic.co/t/does-grok-filter-could-not-change-timestamp/44688/2 "2016-03-17T12:04:29Z")

</div>

Don't capture directly to the `@timestamp` field. Use the date filter to populate that field. For example, capture the timestamp into the `timestamp` field and parse that field with the date filter.

---

<div class="post-metadata">

**Author:** ![abcfy2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abcfy2/32/453_2.png) [@abcfy2](https://discuss.elastic.co/u/abcfy2)\
**Post date:** [March 17, 2016, 12:08pm UTC](https://discuss.elastic.co/t/does-grok-filter-could-not-change-timestamp/44688/3 "2016-03-17T12:08:42Z")

</div>

Thanks. Here is my new config:

```auto
        grok {
            match => { message => 
                "%{TIMESTAMP_ISO8601:timestamp} %{MONGO3_SEVERITY:severity} %{MONGO3_COMPONENT:component}%{SPACE}(?:\[%{DATA:context}\])? %{GREEDYDATA:content}" 
            }
        }

        date {
            match => ["timestamp", "ISO8601"]
            remove_field => "timestamp"
        }

        if [content] =~ "\d+ms$" {
            grok {
                match => { content =>
                    "%{WORD:command} %{WORD:database}\.(?<object>\S+) (?<slow_query>.+?) %{NUMBER:duration:int}ms"
                }
                add_tag => "slow_query"
                remove_field => "content"
            }
        }

```

And it works for me now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/does-grok-filter-could-not-change-timestamp/44688/4 "2017-07-06T05:06:37Z")

</div>