# How to replace @timestamp with field in log

**URL:** https://discuss.elastic.co/t/how-to-replace-timestamp-with-field-in-log/155253
**Category:** Logstash
**Created:** [November 3, 2018, 11:31am UTC](https://discuss.elastic.co/t/how-to-replace-timestamp-with-field-in-log/155253 "2018-11-03T11:31:19Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![manja](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@manja](https://discuss.elastic.co/u/manja)
#### Post date: [November 3, 2018, 11:31am UTC](https://discuss.elastic.co/t/how-to-replace-timestamp-with-field-in-log/155253/1 "2018-11-03T11:31:20Z")

</div>

I want collectd old access log but @timestamp logstash is a time now  
i want replace @timestamp with field = apachetime in log from ex.

{

```
     "message" =&gt; "xxx.xx.xx.xx 222990 - - [31/Oct/2018:10:38:33 +0700] \"GET /xxxxxxx/xxxxxxxxxxService/xxxxxxxxxxxxxService?channel=XXX&amp;clientIpAddress=xxx.xx.xx.xx&amp;clientWorkstationName=XXXXX&amp;requestDateTime=2018-10-31T10:38:00&amp;transactionReferenceId=20181031103800376&amp;uuid=4ADGTLRGC84HE2C4UPP3C6QQ7D&amp;accountNo=xxxxxx&amp;clientUserId=xxxxxx HTTP/1.1\" 200 2092 MX100010000000000 xxxxxxxx",

      "method" =&gt; "\"GET",

      "remote" =&gt; "xxx.xx.xx.xx",

       "local" =&gt; "xxxxxxxx",

        "host" =&gt; "xxxxxxxx",

        "byte" =&gt; "2092",

  "apachetime" =&gt; "31/Oct/2018:10:38:33 +0700",

      "status" =&gt; 200,

       "elasp" =&gt; 222990,

    "@version" =&gt; "1",

       "ident" =&gt; "-",

        "path" =&gt; "/varlog/access_test.log",

        "auth" =&gt; "-",

  "@timestamp" =&gt; 2018-11-03T11:06:01.527Z,

"request_page" =&gt; "/xxxxxxxService/xxxxxxxService/xxxxxxxService?channel=xxx&amp;clientIpAddress=xxx.xx.xx.xx&amp;clientWorkstationName=xxxxxxx&amp;requestDateTime=2018-10-31T10:38:00&amp;transactionReferenceId=20181031103800376&amp;uuid=4ADGTLRGC84HE2C4UPP3C6QQ7D&amp;accountNo=xxxxxxxxx&amp;clientUserId=xxxxxxx",

         "NO8" =&gt; "MX100010000000000",

         "NO7" =&gt; "HTTP/1.1\""

```

}

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 3, 2018, 11:48am UTC](https://discuss.elastic.co/t/how-to-replace-timestamp-with-field-in-log/155253/2 "2018-11-03T11:48:42Z")

</div>

This is done using the [date filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html).

---

<div class="post-metadata">

### Author: ![manja](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@manja](https://discuss.elastic.co/u/manja)
#### Post date: [November 4, 2018, 11:02pm UTC](https://discuss.elastic.co/t/how-to-replace-timestamp-with-field-in-log/155253/3 "2018-11-04T23:02:32Z")

</div>

Thank you.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 2, 2018, 11:05pm UTC](https://discuss.elastic.co/t/how-to-replace-timestamp-with-field-in-log/155253/4 "2018-12-02T23:05:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.