# Elastic timestamp ingest via logstash

**URL:** <https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924>\
**Category:** Elasticsearch\
**Created:** [May 21, 2024, 1:19pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924 "2024-05-21T13:19:25Z")\
**Posts on this page:** 5\
**Page:** 2

<div class="post-metadata">

**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\
**Post date:** [May 25, 2024, 4:09pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/21 "2024-05-25T16:09:12Z")

</div>

Not sure what you mean by JSON event. This is a CSV I am ingesting.

Also I did a rename on accessdat and createdat to be what you see in the kibana screenshot.

if you mean the full line of the actual event I cannot post that here.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 25, 2024, 4:11pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/22 "2024-05-25T16:11:35Z")

</div>

Logstash transforms the CSV data into JSON documemts, which is what is indexed into Elasticsearch. Please show the data in JSON form. You can remove fields not used or containing results of this logic.

If you are renaming fields in your Logstash config, make sure you do it in the correct order so the date filters are correctly configured.

---

<div class="post-metadata">

**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\
**Post date:** [May 25, 2024, 4:15pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/23 "2024-05-25T16:15:31Z")

</div>

This was the order in logstash:

```auto
  date {
        match => ["accessdat","yyyy-MM-dd HH:mm:ss"]
        #target => "accessdat"
 }
    date {
        match => ["createdat", "yyyy-MM-dd HH:mm:ss"]
        #target => "createdat"
 }
  mutate {
      rename => { "accessdat" => "access date"}
      rename => { "createdat" => "create date"}
      }

```

this is a sample row:

"id","user","accessedat","createdat","type","createdipaddress","organization\_id","email\_domain"  
"11111111","22222222","2024-02-19 03:46:15","2024-02-19 03:46:11","persistent","3.3.3.3","","abc.aa"

---

<div class="post-metadata">

**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\
**Post date:** [May 25, 2024, 4:24pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/24 "2024-05-25T16:24:16Z")

</div>

Ok it is working now. I moved the Mutate Rename above the Date match. I see those columns as proper date fields now.

---

<div class="post-metadata">

**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\
**Post date:** [May 25, 2024, 4:29pm UTC](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924/25 "2024-05-25T16:29:53Z")

</div>

I also have a timestamp like this in a different file I need ingested":

2024-05-15T07:25:55+00:00

What would you suggest I use instead of this:

```
    match => ["timestamp", "yyyy-MM-dd HH:mm:ss"]

```

[Previous page](https://discuss.elastic.co/t/elastic-timestamp-ingest-via-logstash/359924.md?page=1)