# I want to change @timestamp value with my message timestamp value
**URL:** https://discuss.elastic.co/t/i-want-to-change-timestamp-value-with-my-message-timestamp-value/209608
**Category:** Logstash
**Created:** [November 27, 2019, 4:56am UTC](https://discuss.elastic.co/t/i-want-to-change-timestamp-value-with-my-message-timestamp-value/209608 "2019-11-27T04:56:34Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@SoniyaGupta](https://discuss.elastic.co/u/SoniyaGupta)
#### Post date: [November 27, 2019, 4:56am UTC](https://discuss.elastic.co/t/i-want-to-change-timestamp-value-with-my-message-timestamp-value/209608/1 "2019-11-27T04:56:34Z")
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 27, 2019, 5:51am UTC](https://discuss.elastic.co/t/i-want-to-change-timestamp-value-with-my-message-timestamp-value/209608/2 "2019-11-27T05:51:48Z")
Then you need to parse out the timestamp into a separate field and use a date filter. See [this introductory guide](https://www.elastic.co/blog/a-practical-introduction-to-logstash) for more information.
---
### Author:  [@SoniyaGupta](https://discuss.elastic.co/u/SoniyaGupta)
#### Post date: [November 27, 2019, 6:10am UTC](https://discuss.elastic.co/t/i-want-to-change-timestamp-value-with-my-message-timestamp-value/209608/3 "2019-11-27T06:10:40Z")
I want Start Time for 10E5F59F-A18D-4840-8E47-7A96F1417398 : As a message
and Wed, 27 Nov 2019 5.58.29.894 as timestamp
Publishing topic For D50CA1C2-CAF4-4822-9AF7-BF28065F15E5 Signal0 with value -0.287098 : Wed, 27 Nov 2019 6.15.44.108
Publishing topic For D50CA1C2-CAF4-4822-9AF7-BF28065F15E5 Signal0 with value -0.287098(Message)
Timestamp- Wed, 27 Nov 2019 6.15.44.108
how i will do seperation based on :
i tried filter {
dissect {
mapping =\> {
"message" =\> "%{msg}: %{timestamp}"
}
remove\_field =\> [“message”]
}
}
got error -An exception happened when converging configuration {:exception=\>RuntimeError, :message=\>"Could not fetch the configuration, message: The following config files contains non-ascii characters but are not UTF-8 encoded ["D:/Logging/logstash-7.4.2/bin/logfile.conf"]", :backtrace=\>["D:/Logging/logstash-7.4.2/logstash-core/lib/logstash/agent.rb:156:in `converge_state_and_update'", "D:/Logging/logstash-7.4.2/logstash-core/lib/logstash/agent.rb:97:in `execute'", "D:/Logging/logstash-7.4.2/logstash-core/lib/logstash/runner.rb:368:in `block in execute'", "D:/Logging/logstash-7.4.2/vendor/bundle/jruby/2.5.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}
i m using 7.4.2 version
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 27, 2019, 6:12am UTC](https://discuss.elastic.co/t/i-want-to-change-timestamp-value-with-my-message-timestamp-value/209608/4 "2019-11-27T06:12:40Z")
You can use grok or a dissect filter as described in the blog I linked to.
---
### Author:  [@SoniyaGupta](https://discuss.elastic.co/u/SoniyaGupta)
#### Post date: [November 27, 2019, 10:53am UTC](https://discuss.elastic.co/t/i-want-to-change-timestamp-value-with-my-message-timestamp-value/209608/5 "2019-11-27T10:53:09Z")
@Christian_Dahlqvist
Wed 27 Nov 2019 10:46:58:589 : Published message For 3024AEA2-D317-4CBD-BFBC-1ED982E33D43 For Topic Signal0 0.432248
filter {
dissect {
mapping =\> { "message" =\> "%{ts} %{+ts} %{+ts} %{+ts} %{+ts} : %{msg}" }
}
}
it is working for me, i want to change data type for ts. coz i want to sort value based on ts.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 25, 2019, 10:55am UTC](https://discuss.elastic.co/t/i-want-to-change-timestamp-value-with-my-message-timestamp-value/209608/6 "2019-12-25T10:55:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.