# Error in Pipeline used within Cisco Umbrella Integration
**URL:** https://discuss.elastic.co/t/error-in-pipeline-used-within-cisco-umbrella-integration/344853
**Category:** Elastic Agent
**Created:** [October 12, 2023, 1:03am UTC](https://discuss.elastic.co/t/error-in-pipeline-used-within-cisco-umbrella-integration/344853 "2023-10-12T01:03:37Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@digital-thought](https://discuss.elastic.co/u/digital-thought)
#### Post date: [October 12, 2023, 1:03am UTC](https://discuss.elastic.co/t/error-in-pipeline-used-within-cisco-umbrella-integration/344853/1 "2023-10-12T01:03:37Z")
I have found an issue with the Cisco Umbrella integration.
I observed that all the events being processed into ELK had a timestamp of when the document was ingested into ELK and not the time/date of the event from Umbrella.
Some looking found the issue with the Pipeline this integration uses.
You will note that the CSV parserver read the event date/time into a field of "cisco.umbrella.\_tmp.time" and then towards the end of the pipeline it does a date conversion to parse the date from the "cisco.umbrella.\_tmp.time" to the "@timestamp" field if the "cisco.umbrella.\_tmp.time" exists.
However, earlier in the pipeline there is a script function that does the following:
"ctx.cisco.umbrella.\_tmp = new HashMap();"
You can see this at line 241 here: [https://github.com/elastic/integrations/blob/main/packages/cisco\_umbrella/data\_stream/log/elasticsearch/ingest\_pipeline/default.yml](https://github.com/elastic/integrations/blob/main/packages/cisco_umbrella/data_stream/log/elasticsearch/ingest_pipeline/default.yml)
As the script overwrites \_tmp to be a HashMap the time is then dropped.
I have manually addressed this by modifying the pipeline to put the time into a different field initially e.g. "cisco.umbrella.time" and then use that field in the date conversion.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 9, 2023, 1:04am UTC](https://discuss.elastic.co/t/error-in-pipeline-used-within-cisco-umbrella-integration/344853/2 "2023-11-09T01:04:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.