# How to keep original date data from json as source to ES

**URL:** <https://discuss.elastic.co/t/how-to-keep-original-date-data-from-json-as-source-to-es/235436>\
**Category:** Elasticsearch\
**Tags:** filebeat\
**Created:** [June 3, 2020, 1:12am UTC](https://discuss.elastic.co/t/how-to-keep-original-date-data-from-json-as-source-to-es/235436 "2020-06-03T01:12:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sirius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sirius/32/47012_2.png) [@Sirius](https://discuss.elastic.co/u/Sirius)\
**Post date:** [June 3, 2020, 1:12am UTC](https://discuss.elastic.co/t/how-to-keep-original-date-data-from-json-as-source-to-es/235436/1 "2020-06-03T01:12:21Z")

</div>

Hello,

I'm shipping json data logs with filebeat to ELK 7.6 version. For some reason date data are substracted by hours when is ingested in ES,, how can I keep original source dates in ES without be modified ?

FIlebeat configuration is:

filebeat.inputs:  
json:  
keys\_under\_root: true  
add\_error\_key: true  
overwrite\_key: true

processors:

- decode\_json\_fields:  
fields: ["message"]  
max\_depth: 2  
target: ""

Filebeat output is sending to logstash. Logstash has not any special configuration just send the data to ES.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 3, 2020, 5:08am UTC](https://discuss.elastic.co/t/how-to-keep-original-date-data-from-json-as-source-to-es/235436/2 "2020-06-03T05:08:25Z")

</div>

All time stamps in Elasticsearch must be in UTC to work properly with e.g. Kibana. Indexing them in another timezone will cause problems.

---

<div class="post-metadata">

**Author:** ![Sirius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sirius/32/47012_2.png) [@Sirius](https://discuss.elastic.co/u/Sirius)\
**Post date:** [June 5, 2020, 2:41am UTC](https://discuss.elastic.co/t/how-to-keep-original-date-data-from-json-as-source-to-es/235436/3 "2020-06-05T02:41:19Z")

</div>

Thanks Christian, even using UTC timezone same problem maybe something else I'm doing wrong. However, using pipeline as below resolved this, overall setting in formats "X" instead of "Z" made keep original dates without changes ...

PUT \_ingest/pipeline/mypipeline  
{  
"description" : "pipeline test",  
"processors" : [  
{  
"date" : {  
"field": "date",  
"target\_field": "date",  
"formats": ["yyyy-MM-dd'T'HH:mm:ss.SSS **X**"],  
"timezone": "Mexico/General"  
}  
}  
]  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 3, 2020, 2:41am UTC](https://discuss.elastic.co/t/how-to-keep-original-date-data-from-json-as-source-to-es/235436/4 "2020-07-03T02:41:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.