# How to transfer original @timestamp from json log to logstash

**URL:** <https://discuss.elastic.co/t/how-to-transfer-original-timestamp-from-json-log-to-logstash/75243>\
**Category:** Logstash\
**Created:** [February 15, 2017, 7:22pm UTC](https://discuss.elastic.co/t/how-to-transfer-original-timestamp-from-json-log-to-logstash/75243 "2017-02-15T19:22:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sagittarius](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@sagittarius](https://discuss.elastic.co/u/sagittarius)\
**Post date:** [February 15, 2017, 7:22pm UTC](https://discuss.elastic.co/t/how-to-transfer-original-timestamp-from-json-log-to-logstash/75243/1 "2017-02-15T19:22:05Z")

</div>

I am trying to setup filebeat-\>logstash-\>elasticsearch chain and I am having problems with @timestamp which is not being transferred from the logfile and a timestamp when the message arrives into logstash is used instead. I will describe it on the example below. I hope somebody will help me understanding this problem and correcting it.

**Logfile has this format:**

{"application":"MyTestApp","source\_host":"apphost01","message":"Hello\_World","@timestamp":"2017-02-14T11:38:32.257Z"}

**filebeat.yml:**

```
filebeat.prospectors:
    - input_type: log
      paths:
        - /tmp/json.log
    output.logstash:
      hosts: ["localhost:5043"]

```

**logstash pipeline conf:**

```
input {
        beats {
            port => "5043"
            codec => json
            type => "log4j-json"
        }
    }
    output {
         stdout { codec => rubydebug }
    }

```

**This is the logstash's output: (notice the @timestamp is different than one in the log entry)**

```
{
    "source_host" => "apphost01",
     "@timestamp" => 2017-02-15T14:47:57.593Z,
    "application" => "MyTestApp",
         "offset" => 118,
       "@version" => "1",
     "input_type" => "log",
           "beat" => {
        "hostname" => "tpl450",
            "name" => "tpl450",
         "version" => "5.2.1"
    },
           "host" => "tpl450",
         "source" => "/tmp/json.log",
        "message" => "Hello_World",
           "type" => "log",
           "tags" => [
        [0] "beats_input_codec_json_applied"
    ]
}
```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 15, 2017, 11:41pm UTC](https://discuss.elastic.co/t/how-to-transfer-original-timestamp-from-json-log-to-logstash/75243/2 "2017-02-15T23:41:40Z")

</div>

I think that is cause it's overwriting the original one. What if you add a date filter that ensures it's carried through?

---

<div class="post-metadata">

**Author:** ![sagittarius](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@sagittarius](https://discuss.elastic.co/u/sagittarius)\
**Post date:** [February 16, 2017, 8:39am UTC](https://discuss.elastic.co/t/how-to-transfer-original-timestamp-from-json-log-to-logstash/75243/3 "2017-02-16T08:39:09Z")

</div>

I tried adding this filter, but I am not sure the filter is correctly set and it did not help:

```
filter {
    date {
        match => ["@timestamp", "ISO8601"]
        target => "@timestamp"
    }
}

```

The output is this:

```
{
    "source_host" => "apphost01",
     "@timestamp" => 2017-02-16T08:29:51.049Z,
    "application" => "MyTestApp",
         "offset" => 594,
       "@version" => "1",
     "input_type" => "log",
           "beat" => {
        "hostname" => "tpl450",
            "name" => "tpl450",
         "version" => "5.2.1"
    },
           "host" => "tpl450",
         "source" => "/tmp/json.log",
        "message" => "Hello_World",
           "type" => "log",
           "tags" => [
        [0] "beats_input_codec_json_applied",
        [1] "_dateparsefailure"
    ]
}

```

So the @timestamp is still not correctly set and I am even getting a \_dateparsefailure.  
Any help is appreciated. Thanks.

---

<div class="post-metadata">

**Author:** ![sagittarius](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@sagittarius](https://discuss.elastic.co/u/sagittarius)\
**Post date:** [February 16, 2017, 12:52pm UTC](https://discuss.elastic.co/t/how-to-transfer-original-timestamp-from-json-log-to-logstash/75243/4 "2017-02-16T12:52:13Z")

</div>

Any ideas how to make logstash not overwriting @timestamp json key from the original log entry?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2017, 12:52pm UTC](https://discuss.elastic.co/t/how-to-transfer-original-timestamp-from-json-log-to-logstash/75243/5 "2017-03-16T12:52:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.