# Get the right timestamp for old log files
**URL:** https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943
**Category:** Logstash
**Created:** [July 6, 2015, 11:21am UTC](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943 "2015-07-06T11:21:30Z")
**Posts on this page:** 8
**Page:** 4
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 27, 2015, 8:19pm UTC](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943/62 "2015-07-27T20:19:20Z")
Use the `remove_field` parameter of any filter, preferably the date filter that makes the `mytimestamp` field superfluous.
---
### Author:  [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)
#### Post date: [July 28, 2015, 7:42am UTC](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943/63 "2015-07-28T07:42:49Z")
So I should put the the remove\_field parameter right under the match parameter under the date filter?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 28, 2015, 7:52am UTC](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943/64 "2015-07-28T07:52:56Z")
Anywhere in the date filter will do, but putting it at the end makes sense.
---
### Author:  [@Surbhi\_Agarwal](https://discuss.elastic.co/u/Surbhi_Agarwal)
#### Post date: [October 20, 2015, 10:11am UTC](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943/65 "2015-10-20T10:11:26Z")
I have used the same timestamp format to target the @timestamp with the timestamp of my log file. But I got the \_dateparsefailure and \_grokparsefailure.
This is my config file
input
{
file
{
```
path => "C:\Users\eagasur\logs1.log"
start_position => "beginning"
```
}
}
filter
{
grok
{
match =\> ["message", "%{MONTHDAY:day}/%{MONTHNUM:month}/%{YEAR:year}%:%{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second} %{ISO8601\_TIMEZONE:timezone} %{LOGLEVEL:log\_level} %{NUMBER:line:int}"]
}
ruby
{
code=\> "hr=event['hour'].to\_i ;
min = event['minute'].to\_i ;
sec = event['second'].to\_i;
hr\_to\_sec = hr \* 60 \* 60;
min\_to\_sec = min \* 60;
total= hr\_to\_sec + min\_to\_sec + sec ;
event['time']=total \* 1000;
event['difference'] = event['time'].to\_i - var1;
var1=event['time'].to\_i"
}
mutate
{
add\_field =\> { "timestamp" =\> "%{day}/%{month}/%{year}:%{hour}:%{minute}:%{second} %{timezone}" }
}
date
{
match =\> ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
}
}
output
{
stdout
{
codec =\> rubydebug{}
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 20, 2015, 10:53am UTC](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943/66 "2015-10-20T10:53:42Z")
@Surbhi_Agarwal, please start a new topic for your unrelated question.
---
### Author:  [@Surbhi\_Agarwal](https://discuss.elastic.co/u/Surbhi_Agarwal)
#### Post date: [October 21, 2015, 5:10am UTC](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943/67 "2015-10-21T05:10:04Z")
@simonrisberg @magnusbaeck
I have used the same procedure for targetting my timestamp with the logstash timestamp. But got \_dateparsefailure and \_grokparsefailure.
This is my config file.Could you please find out the error :
input
{
file
{
path =\> "C:\Users\eagasur\logs1.log"
start\_position =\> "beginning"
```
}
```
}
filter
{
grok
{
match =\> ["message", "%{MONTHDAY:day}/%{MONTHNUM:month}/%{YEAR:year}:%{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second} %{ISO8601\_TIMEZONE:timezone}"]
}
mutate
{
add\_field =\>
{
"timestamp" =\> "%{day}/%{month}/%{year}:%{hour}:%{minute}:%{second} %{timezone}"
}
}
date
{
match =\> ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
}
}
output
{
stdout
{
codec =\> rubydebug{}
}
}
---
### Author:  [@mkorayem](https://discuss.elastic.co/u/mkorayem)
#### Post date: [April 11, 2017, 2:28pm UTC](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943/68 "2017-04-11T14:28:02Z")
Would you please upload your configuration.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:27am UTC](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943/69 "2017-07-06T04:27:11Z")
[Previous page](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943.md?page=3)