# Grok filter TIMESTAMP\_ISO8601 appears in Kibana as String

**URL:** <https://discuss.elastic.co/t/grok-filter-timestamp-iso8601-appears-in-kibana-as-string/258240>\
**Category:** Logstash\
**Created:** [December 10, 2020, 9:27am UTC](https://discuss.elastic.co/t/grok-filter-timestamp-iso8601-appears-in-kibana-as-string/258240 "2020-12-10T09:27:54Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![SecretSquizza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/secretsquizza/32/77449_2.png) [@SecretSquizza](https://discuss.elastic.co/u/SecretSquizza)\
**Post date:** [December 14, 2020, 12:27pm UTC](https://discuss.elastic.co/t/grok-filter-timestamp-iso8601-appears-in-kibana-as-string/258240/3 "2020-12-14T12:27:27Z")

</div>

Hi @Badger,

I think i've made some limited progress based on what you've said and following [this post](https://discuss.elastic.co/t/date-format-for-yyyy-mm-dd-hh-mm-ss-sss/80702)

My Grok filter / date filters now look like this:

```
grok {
      match => {
        "message" => "(?<serverid>([a-z]{3}[0-9]{2}[a-z]{2}[0-9]{2}){0,1})\s+(?<username>([A-Za-z0-9.@\-]*){0,1})\s+(%{TIMESTAMP_ISO8601:logdate})?\s+(%{LOGLEVEL:loglevel})\s+(?<classname>([^\s]+){0,1})\s+%{GREEDYDATA:body}"
      }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
      tag_on_failure => ["_not_interested"]
    }
    date {
       match => ["logdate", "YYYY-MM-dd HH:mm:ss,SSS"]
       target => "logdate"
    }

```

I was hoping that, following this change, when i created a new index pattern, i'd have the option of using "logdate" as the time field, but it isn't showing in the list and, if i proceed to create the index pattern on @timestamp then logdate still shows as a String in the field list on the next page.

I can see its made a change to the output in Discover view now as the Logdate is now showing slightly differently to the Original Input:

Before

`2020-12-14 12:18:51,397`

After

`2020-12-14T12:18:51.397Z`

Any further suggestions?

Many thanks,  
Ade.

---

_[View the full topic](https://discuss.elastic.co/t/grok-filter-timestamp-iso8601-appears-in-kibana-as-string/258240)._