# How to override logstash @timestamp value with my date time field from the logs
**URL:** https://discuss.elastic.co/t/how-to-override-logstash-timestamp-value-with-my-date-time-field-from-the-logs/71026
**Category:** Logstash
**Created:** [January 10, 2017, 6:09am UTC](https://discuss.elastic.co/t/how-to-override-logstash-timestamp-value-with-my-date-time-field-from-the-logs/71026 "2017-01-10T06:09:29Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@ankkha](https://discuss.elastic.co/u/ankkha)
#### Post date: [January 10, 2017, 6:09am UTC](https://discuss.elastic.co/t/how-to-override-logstash-timestamp-value-with-my-date-time-field-from-the-logs/71026/1 "2017-01-10T06:09:29Z")
My logs
Dec 12 13:45:43 [0x80000001][xsltmsg][notice]|6583|3018|0x00000000-0x00000000|235|
Dec 12 14:45:43 [0x80000001][xsltmsg][notice]|6583|3018|0x00000000-0x00000000|205|
My logstash config
filter {
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:Call\_Time} %{WORD:ApplicationName} }
}
date {
match =\> ["Call\_Time", "yyyy-MM-dd HH:mm:ss,SSS"]
}
}
In output I can see Call\_Time value is Dec 12 13:45:43
but since old logs needs to be mapped with the time when it was actually written instead loading time because kibana shows when you upload the logs that is why trying to override @timestamp value with the log creation date time
Also it would be great if someone can help me how to interpret \_dateparsefailure tag.. i am seeing this on my console but don't know where to see to know exactly what went wrong while parsing date.
please execuse my less knowledge , i am new here.
---
### Author:  [@nick.e](https://discuss.elastic.co/u/nick.e)
#### Post date: [January 10, 2017, 6:26am UTC](https://discuss.elastic.co/t/how-to-override-logstash-timestamp-value-with-my-date-time-field-from-the-logs/71026/2 "2017-01-10T06:26:37Z")
[Date-Filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-match) expects a pattern matching your timeformat in the match-part.
Your pattern **yyyy-MM-dd HH:mm:ss,SSS** can't match your timestamp **Dec 12 13:45:43**.
The pattern you need should look like the following:
`match => ["Call_Time", "MMM dd HH:mm:ss"]`
**but** : You don't have a year in your logfile, so Logstash will default to the year when the Logstash process started. More information here [Syslog date without year](https://discuss.elastic.co/t/syslog-date-without-year/29834).
---
### Author:  [@ankkha](https://discuss.elastic.co/u/ankkha)
#### Post date: [January 10, 2017, 7:00am UTC](https://discuss.elastic.co/t/how-to-override-logstash-timestamp-value-with-my-date-time-field-from-the-logs/71026/3 "2017-01-10T07:00:57Z")
Awesome ... Too good.... Quickest help....
It solved my problem.... Thank you so much
---
### Author:  [@ankkha](https://discuss.elastic.co/u/ankkha)
#### Post date: [January 10, 2017, 7:03am UTC](https://discuss.elastic.co/t/how-to-override-logstash-timestamp-value-with-my-date-time-field-from-the-logs/71026/4 "2017-01-10T07:03:00Z")
What about timezone? My logs are in US CST Timezone.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 10, 2017, 7:11am UTC](https://discuss.elastic.co/t/how-to-override-logstash-timestamp-value-with-my-date-time-field-from-the-logs/71026/5 "2017-01-10T07:11:58Z")
> You don't have a year in your logfile, so Logstash will default to the year when the Logstash process started.
That's only true for old versions of the date filter. The behavior is better as of (I think) v2.1.0 of the filter.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 10, 2017, 7:13am UTC](https://discuss.elastic.co/t/how-to-override-logstash-timestamp-value-with-my-date-time-field-from-the-logs/71026/6 "2017-01-10T07:13:20Z")
> What about timezone? My logs are in US CST Timezone.
As documented Logstash defaults to the computer's timezone. If the logs from a different timezone use the date filter's `timezone` option. The resulting timestamp in the `@timestamp` will always be UTC.
---
### Author:  [@ankkha](https://discuss.elastic.co/u/ankkha)
#### Post date: [January 10, 2017, 7:58am UTC](https://discuss.elastic.co/t/how-to-override-logstash-timestamp-value-with-my-date-time-field-from-the-logs/71026/7 "2017-01-10T07:58:37Z")
Thank you Magnus
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 7, 2017, 7:58am UTC](https://discuss.elastic.co/t/how-to-override-logstash-timestamp-value-with-my-date-time-field-from-the-logs/71026/8 "2017-02-07T07:58:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.