# Dotnet core log - filter timestamp from log entry (filebeat, logstash)

**URL:** <https://discuss.elastic.co/t/dotnet-core-log-filter-timestamp-from-log-entry-filebeat-logstash/126095>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 29, 2018, 1:00pm UTC](https://discuss.elastic.co/t/dotnet-core-log-filter-timestamp-from-log-entry-filebeat-logstash/126095 "2018-03-29T13:00:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mason\_Batley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mason_batley/32/29357_2.png) [@Mason\_Batley](https://discuss.elastic.co/u/Mason_Batley)\
**Post date:** [March 29, 2018, 1:00pm UTC](https://discuss.elastic.co/t/dotnet-core-log-filter-timestamp-from-log-entry-filebeat-logstash/126095/1 "2018-03-29T13:00:29Z")

</div>

Hi gang,

I'm importing logs from a dotnet core app using serilog and the output messages in the log file look like this. I need to work out out to extract the timestamp from the log entry line and use that as the @timestamp value to pass onto Logstash rather than using the default timestamp when the line was read.

The value I want to extra and use below is "2018-03-20 00:20:31.388 +02:00", do I need to use a grok filter in the file beats configuration which would extra the value and produce the new @timestamp field?

Thank you in advance!

{  
"@version" =\> "1",  
"host" =\> "8c94f1cff471",  
"tags" =\> [  
[0] "beats\_input\_codec\_plain\_applied"  
],  
"offset" =\> 25904,  
"@timestamp" =\> 2018-03-29T11:57:29.167Z,  
"fields" =\> {  
"appenvironment" =\> "myapp",  
"appsource" =\> "backend-service"  
},  
"message" =\> "2018-03-20 00:20:31.388 +02:00 [Information] Request finished in 12.7239ms 200 ",  
"prospector" =\> {  
"type" =\> "log"  
},  
"beat" =\> {  
"version" =\> "6.2.3",  
"name" =\> "8c94f1cff471",  
"hostname" =\> "8c94f1cff471"  
},  
"source" =\> "/var/log/app/backend-kestrel-20180320.log"  
}

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 29, 2018, 2:40pm UTC](https://discuss.elastic.co/t/dotnet-core-log-filter-timestamp-from-log-entry-filebeat-logstash/126095/2 "2018-03-29T14:40:45Z")

</div>

Filebeat does not parse any contents. It's purpose is on shipping the logs.

Processing the timestamp can be done in Logstash. In Logstash you might also want to rename `@timestamp` to `read_timestamp` + add a `receive_timestamp`. This way you can compute latencies in your log-processing.

---

<div class="post-metadata">

**Author:** ![Mason\_Batley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mason_batley/32/29357_2.png) [@Mason\_Batley](https://discuss.elastic.co/u/Mason_Batley)\
**Post date:** [March 30, 2018, 10:12pm UTC](https://discuss.elastic.co/t/dotnet-core-log-filter-timestamp-from-log-entry-filebeat-logstash/126095/3 "2018-03-30T22:12:36Z")

</div>

> [@Mason\_Batley](#):
>
> +02:00

is there a standard grok filter timestamp for this date format having the timezone as "+02:00" for example that I can use in logstash?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 3, 2018, 1:00pm UTC](https://discuss.elastic.co/t/dotnet-core-log-filter-timestamp-from-log-entry-filebeat-logstash/126095/4 "2018-04-03T13:00:49Z")

</div>

Why not parse the timezone into a separate field? Timezone information can be used to normalize timestamps to UTC-0, plus they can be useful for filtering.

The grok filter comes with 120+ predefined patterns, but I don't know if any of these predefined patterns captures the timezone as well.

Check out the [grok filters documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#_description_115). It contains links to all predefined patterns + grokdebug/grokconstructor.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2018, 1:01pm UTC](https://discuss.elastic.co/t/dotnet-core-log-filter-timestamp-from-log-entry-filebeat-logstash/126095/5 "2018-05-01T13:01:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.