# Filebeat timestamp processsor doesn't parse microseconds part

**URL:** <https://discuss.elastic.co/t/filebeat-timestamp-processsor-doesnt-parse-microseconds-part/248591>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 14, 2020, 11:27pm UTC](https://discuss.elastic.co/t/filebeat-timestamp-processsor-doesnt-parse-microseconds-part/248591 "2020-09-14T23:27:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![6NMgfDwZ3](https://avatars.discourse-cdn.com/v4/letter/6/ac91a4/32.png) [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\
**Post date:** [September 14, 2020, 11:27pm UTC](https://discuss.elastic.co/t/filebeat-timestamp-processsor-doesnt-parse-microseconds-part/248591/1 "2020-09-14T23:27:50Z")

</div>

Hi,

this is the first part of my `filebeat.xml`

```auto
filebeat.inputs:
  - type: tcp
    enabled: true
    host: "localhost:9000"

processors:
  - decode_json_fields:
      fields: ["message"]
      process_array: true
      target: ""
      add_error_key: true
# overwrite_keys: true
      max_depth: 2
  - timestamp:
      field: xxtimestamp
      layouts:
        - '2020-01-02T12:34:56.123456Z'
  - drop_fields:
      fields: [xxtimestamp]

```

(nothing fancy in the second part)

My application sends JSON messages to Filebeat through TCP. Filebeat parsing the messages add some Filebeat specific fields and forwards it to Elasticsearch/Kibana.

I have an `xxtimestamp` field in the JSON message which contains an ISO8601 timestamp, like `'2020-01-02T12:34:56.123456Z'`  
I'd like to replace `@timestamp`'s field content with `xxtimestamp`'s content.

Its working with the config above but this method cuts off the microseconds part

e.g.: `'2020-01-02T12:34:56.123456Z'` -\> `'2020-01-02T12:34:56.123000Z`

How could I increase this date precision?

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [September 15, 2020, 7:18am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processsor-doesnt-parse-microseconds-part/248591/2 "2020-09-15T07:18:48Z")

</div>

I'm not convinced if it's not a bug. Filebeat should support up to nanoseconds precision for timestamps (for reference: [https://github.com/elastic/beats/pull/9818](https://github.com/elastic/beats/pull/9818)).

Which filebeat version are you using?

---

<div class="post-metadata">

**Author:** ![6NMgfDwZ3](https://avatars.discourse-cdn.com/v4/letter/6/ac91a4/32.png) [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\
**Post date:** [September 15, 2020, 8:05am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processsor-doesnt-parse-microseconds-part/248591/3 "2020-09-15T08:05:44Z")

</div>

Filebeat:  
(`apt show filebeat`)

```auto
Package: filebeat
Version: 7.9.1
Priority: extra
Section: default
Maintainer: <@5834351aa1d6>
...
APT-Sources: https://artifacts.elastic.co/packages/oss-7.x/apt stable/main amd64 Packages

```

Kibana:  
(`apt show kibana-oss`)

```auto
Package: kibana-oss
Version: 7.9.1
Priority: optional
Section: default
Maintainer: Kibana Team <info@elastic.co>
...
APT-Sources: https://artifacts.elastic.co/packages/oss-7.x/apt stable/main amd64 Packages

```

Elasticsearch:  
(`apt show elasticsearch-oss`)

```auto
Package: elasticsearch-oss
Version: 7.9.1
Priority: optional
Section: web
Source: elasticsearch-oss
Maintainer: Elasticsearch Team <info@elastic.co>
...
Depends: bash (>= 4.1), lsb-base (>= 4), libc6, adduser, coreutils (>= 8.4)
...
APT-Sources: https://artifacts.elastic.co/packages/oss-7.x/apt stable/main amd64 Packages
...

```

---

<div class="post-metadata">

**Author:** ![6NMgfDwZ3](https://avatars.discourse-cdn.com/v4/letter/6/ac91a4/32.png) [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\
**Post date:** [October 2, 2020, 7:58am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processsor-doesnt-parse-microseconds-part/248591/4 "2020-10-02T07:58:21Z")

</div>

Do you think the issue which you posted related to 7.9.1?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 30, 2020, 9:58am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processsor-doesnt-parse-microseconds-part/248591/5 "2020-10-30T09:58:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.