# Elastic timestamp ingest via logstash
**URL:** https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924
**Category:** Elasticsearch
**Created:** [May 21, 2024, 1:19pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924 "2024-05-21T13:19:25Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@dfir](https://discuss.elastic.co/u/dfir)
#### Post date: [May 21, 2024, 1:19pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/1 "2024-05-21T13:19:25Z")
I have a CSV file I am ingesting. The 'timestamp' field shows the time like this: 2024-03-14 09:30:58.000.
In Logstash my Date Filter is show below. When the ingest runs the elastic index shows the timestamp field as text and not a proper timestamp field. Can someone tell me what is wrong here?
```auto
date {
match => ["Timestamp","YYYY-MM-dd HH:mm:ss"]
}
```
I have tried the yyyy in both upper and lowercase, neither work.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [May 21, 2024, 2:13pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/2 "2024-05-21T14:13:24Z")
There are two issues in your case.
> [@dfir](#):
>
> When the ingest runs the elastic index shows the timestamp field as text and not a proper timestamp field.
This is related to the mapping of the field, you need to adjuste the mapping of the `Timestamp` field in your template to be a `date` type.
> [@dfir](#):
>
> ```auto
> date {
> match => ["Timestamp","YYYY-MM-dd HH:mm:ss"]
> }
>
> ```
This filter would parse your `Timestamp` field using the specified format and store it in the `@timestamp` field, which is the default `target`, but the issue here is that the format is wrong, it does not match your date string.
Your date string is this: `2024-03-14 09:30:58.000`, but your format will not match because it is missing the miliseconds, it should be `YYYY-MM-dd HH:mm:ss.SSS`
---
### Author:  [@dfir](https://discuss.elastic.co/u/dfir)
#### Post date: [May 21, 2024, 2:19pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/3 "2024-05-21T14:19:01Z")
Are you suggesting this config? I had this mutate convert filter earlier, but logstash error'd out. It said the timestamp convert needed to be string, boolean, or keyword.
```auto
}
mutate {
convert => { "timestamp" => "date"
}
}
date {
match => ["timestamp","YYYY-MM-dd HH:mm:ss.SSS"]
}
```
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [May 21, 2024, 2:23pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/4 "2024-05-21T14:23:01Z")
> [@dfir](#):
>
> Are you suggesting this config?
No, the mapping is done in Elasticsearch side, not on Logstash, if you didn't specify a mapping for your index while creating it or using an index template, Elasticsearch will try to infer the type of the field, but sometimes it does not infer the correct type, which seems to be your case.
You need to change the type in elasticsearch by recreating the index with the correct mapping or using an index template and then create a new index.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 21, 2024, 2:24pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/5 "2024-05-21T14:24:38Z")
> [@dfir](#):
>
> ```auto
> date {
> match => ["timestamp","YYYY-MM-dd HH:mm:ss.SSS"]
> }
>
> ```
Try something like this:
```auto
date {
match => ["Timestamp","YYYY-MM-dd HH:mm:ss.SSS"]
target => "Timestamp"
}
```
This should format the field so that it matches the format Elasticsearch requires to dynamically map it as a date.
You will need to start with a new index as the existing mapping will not be changed.
---
### Author:  [@dfir](https://discuss.elastic.co/u/dfir)
#### Post date: [May 21, 2024, 2:27pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/6 "2024-05-21T14:27:23Z")
Thanks. This worked. Now I have the correct timestamp showing up. Thanks Folks for your assistance.
---
### Author:  [@dfir](https://discuss.elastic.co/u/dfir)
#### Post date: [May 25, 2024, 3:16pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/7 "2024-05-25T15:16:23Z")
I now have 2 columns to add in a date filter. This config I thought would work but it is not:
```auto
date {
match => ["accessdat","yyyy-MM-dd HH:mm:ss", "createdat","yyyy-MM-dd HH:mm:ss"]
target => ["accessdat", "createdat"]
}
```
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 25, 2024, 3:20pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/8 "2024-05-25T15:20:02Z")
Use the date filter twice, once for each field.
---
### Author:  [@dfir](https://discuss.elastic.co/u/dfir)
#### Post date: [May 25, 2024, 3:21pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/9 "2024-05-25T15:21:53Z")
Thanks, Will try it now.
---
### Author:  [@dfir](https://discuss.elastic.co/u/dfir)
#### Post date: [May 25, 2024, 3:33pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/10 "2024-05-25T15:33:18Z")
For a CSV ingest should pipeline.workers be set to 1?
---
### Author:  [@Joey\_Jackson](https://discuss.elastic.co/u/Joey_Jackson)
#### Post date: [May 25, 2024, 3:34pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/11 "2024-05-25T15:34:07Z")
date {
match =\> ["Timestamp","YYYY-MM-dd HH:mm:ss"]
}
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 25, 2024, 3:35pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/12 "2024-05-25T15:35:44Z")
> [@dfir](#):
>
> For a CSV ingest should pipeline.workers be set to 1?
No, that is not required.
---
### Author:  [@dfir](https://discuss.elastic.co/u/dfir)
#### Post date: [May 25, 2024, 3:38pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/13 "2024-05-25T15:38:55Z")
Thanks. Restarting this process. Logstash is running but index so far has 0 size to it.
---
### Author:  [@dfir](https://discuss.elastic.co/u/dfir)
#### Post date: [May 25, 2024, 3:53pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/14 "2024-05-25T15:53:02Z")
The Timestamp fields are not working.
Here is my config:
```auto
date {
match => ["accessdat","yyyy-MM-dd HH:mm:ss"]
target => "accessdat"
}
date {
match => ["createdat", "yyyy-MM-dd HH:mm:ss"]
target => "createdat"
}
```
Here is how they appear in the log:
```auto
2024-02-19 03:46:11
```
and here is how they show up:
2024-03-11T09:59:29.000Z
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 25, 2024, 3:55pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/15 "2024-05-25T15:55:43Z")
Change the target field so it does not overwrite, then please share a sample event showing the issue.
---
### Author:  [@dfir](https://discuss.elastic.co/u/dfir)
#### Post date: [May 25, 2024, 3:56pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/16 "2024-05-25T15:56:21Z")
Meaning change Target to a different name all together, or just comment it out?
---
### Author:  [@dfir](https://discuss.elastic.co/u/dfir)
#### Post date: [May 25, 2024, 4:00pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/17 "2024-05-25T16:00:06Z")
When I comment out the target =\> they show up like this. The index shows them as text columns. not actual date columns
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 25, 2024, 4:01pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/18 "2024-05-25T16:01:38Z")
Please show the full JSON document.
---
### Author:  [@dfir](https://discuss.elastic.co/u/dfir)
#### Post date: [May 25, 2024, 4:03pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/19 "2024-05-25T16:03:54Z")
Can only show partial with times:
looks like it is putting the @timestamp == the Create Date.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 25, 2024, 4:07pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/20 "2024-05-25T16:07:26Z")
It doesn't look like the field names match what is the event. Please show the JSON event, not screenshots from Kibana.
[Next page](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924.md?page=2)