# How to synchronize tcpdump/pcap file time with kibana?

**URL:** <https://discuss.elastic.co/t/how-to-synchronize-tcpdump-pcap-file-time-with-kibana/91706>\
**Category:** Kibana\
**Created:** [July 4, 2017, 2:50am UTC](https://discuss.elastic.co/t/how-to-synchronize-tcpdump-pcap-file-time-with-kibana/91706 "2017-07-04T02:50:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gurram\_Vinay](https://avatars.discourse-cdn.com/v4/letter/g/85e7bf/32.png) [@Gurram\_Vinay](https://discuss.elastic.co/u/Gurram_Vinay)\
**Post date:** [July 4, 2017, 2:50am UTC](https://discuss.elastic.co/t/how-to-synchronize-tcpdump-pcap-file-time-with-kibana/91706/1 "2017-07-04T02:50:28Z")

</div>

I have a JSON data of pcap file as shown in

 ![](https://us1.discourse-cdn.com/elastic/original/3X/2/8/288117434188742dbf5b3a8e0878791fa341eec5.PNG)  
I want to synchronize in kibana, but Here in kibana, "Index contains time-based events" (if I checked the box then unable to load the "Time-field name"),If I unchecked the box only visualising the normal data with any time frame.

I want to see data with checked time at "Index contains time-based events" along with pcap time frame.

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [July 4, 2017, 9:52am UTC](https://discuss.elastic.co/t/how-to-synchronize-tcpdump-pcap-file-time-with-kibana/91706/2 "2017-07-04T09:52:31Z")

</div>

Hi @Gurram_Vinay,

in order to be able to select a field as the time-field in Kibana it has to have the [`date`](https://www.elastic.co/guide/en/elasticsearch/reference/current/date.html) type in the mapping. Looking at the time fields in the JSON samples you posted you would probably have to preprocess them during ingestion in order for Elasticsearch to parse it correctly as timestamps.

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [July 4, 2017, 9:55am UTC](https://discuss.elastic.co/t/how-to-synchronize-tcpdump-pcap-file-time-with-kibana/91706/3 "2017-07-04T09:55:17Z")

</div>

Another option might be to use [Packetbeat](https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-overview.html) to ingest the pcap files directly. With that you would also gain access to preconfigured example dashboards in Kibana.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 1, 2017, 9:55am UTC](https://discuss.elastic.co/t/how-to-synchronize-tcpdump-pcap-file-time-with-kibana/91706/4 "2017-08-01T09:55:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.