# Get the right timestamp for old log files

**URL:** https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943
**Category:** Logstash
**Created:** [July 6, 2015, 11:21am UTC](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943 "2015-07-06T11:21:30Z")
**Posts on this page:** 1
**Showing post:** 57

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 24, 2015, 9:53am UTC](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943/57 "2015-07-24T09:53:49Z")

</div>

Okay. You have a single grok filter with multiple expressions. With the default true value of [`break_on_match`](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-break_on_match) grok will stop once it gets a match. You need to disable that or split your multi-expression grok filter into two separate filters.

---

_[View the full topic](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943)._