# How to avoid timestamp field getting appeared in Output **URL:** \ **Category:** Logstash\ **Created:** [December 17, 2015, 9:49pm UTC](https://discuss.elastic.co/t/how-to-avoid-timestamp-field-getting-appeared-in-output/37512 "2015-12-17T21:49:10Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![gaurav1424](https://avatars.discourse-cdn.com/v4/letter/g/97f17d/32.png) [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\ **Post date:** [December 17, 2015, 9:49pm UTC](https://discuss.elastic.co/t/how-to-avoid-timestamp-field-getting-appeared-in-output/37512/1 "2015-12-17T21:49:10Z")
Here is my Configuration file: input { tcp { port =\> 5000 #type =\> syslog } udp { port =\> 5000 #type =\> syslog } } filter { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp}\s+%{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } remove\_field =\> ["@version", "host", "message", "@timestamp"] add\_field =\> ["received\_at", "%{@timestamp}"] #add\_field =\> ["received\_from", "%{host}"] } syslog\_pri { } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } output { stdout { codec =\> rubydebug } } Here is my Output : { "syslog\_timestamp" =\> "Dec 8 23:11:57", "syslog\_hostname" =\> "[reg-mx480-1.tlab.com](http://reg-mx480-1.tlab.com)", "syslog\_program" =\> "dcd", "syslog\_pid" =\> "79823", "syslog\_message" =\> "unknown encaps\_ohead; dev ams0, encaps 0, flags 0x1, addr-fam 2, ifdp\_type=104, overhead=-1\r", "received\_at" =\> "2015-12-15T22:57:56.856Z", "syslog\_severity\_code" =\> 5, "syslog\_facility\_code" =\> 1, "syslog\_facility" =\> "user-level", "syslog\_severity" =\> "notice", "@timestamp" =\> "2015-12-09T07:11:57.000Z" \<\<\< i need to remove this. } Though I am explicitly removing the @timestamp field, It is still appearing in output. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 17, 2015, 10:36pm UTC](https://discuss.elastic.co/t/how-to-avoid-timestamp-field-getting-appeared-in-output/37512/2 "2015-12-17T22:36:17Z")
You're indeed removing `@timestamp` in your grok filter but you're adding it right back with your date filter. I'd expect you to be more interested in deleting the `syslog_timestamp` field. ---
**Author:** ![gaurav1424](https://avatars.discourse-cdn.com/v4/letter/g/97f17d/32.png) [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\ **Post date:** [December 17, 2015, 11:55pm UTC](https://discuss.elastic.co/t/how-to-avoid-timestamp-field-getting-appeared-in-output/37512/3 "2015-12-17T23:55:26Z")
Nope. I need two timestamps 1: syslog\_timesatmp =\> which is syslog message 2: current time at which logstash instance is receiving this message. So in above example : "syslog\_timestamp" =\> "Dec 8 23:11:57", and "received\_at" =\> "2015-12-15T22:57:56.856Z", I dont need this "@timestamp" =\> "2015-12-09T07:11:57.000Z" ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 18, 2015, 4:46am UTC](https://discuss.elastic.co/t/how-to-avoid-timestamp-field-getting-appeared-in-output/37512/4 "2015-12-18T04:46:22Z")
Then set the `target` option of the date filter to store the parsed date in the `syslog_timestamp` field instead of in `@timestamp` which is the default. ---
**Author:** ![gaurav1424](https://avatars.discourse-cdn.com/v4/letter/g/97f17d/32.png) [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\ **Post date:** [January 22, 2016, 1:36am UTC](https://discuss.elastic.co/t/how-to-avoid-timestamp-field-getting-appeared-in-output/37512/5 "2016-01-22T01:36:07Z")
Thanks ! My log Line is : Dec 8 23:12:20 HOSTNAME mgd[41101]: UI\_DBASE\_LOGIN\_EVENT: User 'SDNSS' entering configuration mode And what I am getting after parsing is : { "syslog\_timestamp" =\> "Dec 8 23:12:20", "syslog\_hostname" =\> "HOSTNAME", "syslog\_program" =\> "mgd", "syslog\_pid" =\> "41101", "syslog\_message" =\> "UI\_DBASE\_LOGIN\_EVENT: User 'SDNSS' entering configuration mode\r", "syslog\_severity\_code" =\> 5, "syslog\_facility\_code" =\> 1, "syslog\_facility" =\> "user-level", "syslog\_severity" =\> "notice", "@timestamp" =\> "2016-12-09T07:12:20.000Z" } How the value of @timestamp field is getting populated here ? Clearly we see syslog message contains dated 8th dec at 11 PM, and I have sent this message to logstash on 21st Jan, 2016 around 5.30 PM. How that timestamp field is getting populated and displayed ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 22, 2016, 6:53am UTC](https://discuss.elastic.co/t/how-to-avoid-timestamp-field-getting-appeared-in-output/37512/6 "2016-01-22T06:53:33Z")
Use the date filter to populate the `@timestamp` field with the actual timestamp of each event. If you don't the field will contain the current time when Logstash received the message. ---
**Author:** ![gaurav1424](https://avatars.discourse-cdn.com/v4/letter/g/97f17d/32.png) [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\ **Post date:** [January 22, 2016, 6:52pm UTC](https://discuss.elastic.co/t/how-to-avoid-timestamp-field-getting-appeared-in-output/37512/7 "2016-01-22T18:52:10Z")
Thanks Mate. I think you didnt understand the problem here. Here is my filter section filter { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp}\s+%{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } remove\_field =\> ["@version", "host", "message", "@timestamp"] } date { target =\> "syslog\_timestamp" match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } As you have suggested earlier, I have put target in date filter as syslog\_timestamp. so here are two problems : 1: So with this as input line for above filter section Dec 8 23:12:36 HOSTNAME dcd[46711]: unknown encaps\_ohead; dev ams0, encaps 0, flags 0x1, addr-fam 2, ifdp\_type=104, overhead=-1 What I am getting output of logstash is : { "syslog\_timestamp" =\> "2016-12-09T07:12:36.000Z", "syslog\_hostname" =\> "HOSTNAME", "syslog\_program" =\> "dcd", "syslog\_pid" =\> "46711", "syslog\_message" =\> "unknown encaps\_ohead; dev ams0, encaps 0, flags 0x1, addr-fam 2, ifdp\_type=104, overhead=-1\r", } Now problem is from where logstash is getting this date : 2016-12-09T07:12:36.000Z I have told date filter to take a date from syslog\_timestamp which Dec 8 2015 at 11 PM roughly. I dont understand why is this ? and from where its getting this time. The machine on which logstash is running current time is : Thu Jan 21 19:44:24 PST 2016 2: I have simple requirement here I will push syslog events from multiple network providers at any random time to my logstash instance. I want to get ONLY two timestamps. - One which I see in syslog event - One at which logstash instance receives this message. I am not able to figure it out how can I get this simple requirement done. I am sorry but Date filter and Grok filter documentation does not tell anything about timestamp and their manipulation. I hope you understand what I am trying to say here. Thanks, Gaurav ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 23, 2016, 4:26pm UTC](https://discuss.elastic.co/t/how-to-avoid-timestamp-field-getting-appeared-in-output/37512/8 "2016-01-23T16:26:19Z")
> Now problem is from where logstash is getting this date : 2016-12-09T07:12:36.000Z > I have told date filter to take a date from syslog\_timestamp which Dec 8 2015 at 11 PM roughly. As explained in another thread, `@timestamp` is expected to be UTC. Same goes for all fields populated by the date filter. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:14am UTC](https://discuss.elastic.co/t/how-to-avoid-timestamp-field-getting-appeared-in-output/37512/9 "2017-07-06T05:14:40Z")