# Is filebeat able to index in elasticsearch with the date of the log line it reads, not the the date of the day?

**URL:** <https://discuss.elastic.co/t/is-filebeat-able-to-index-in-elasticsearch-with-the-date-of-the-log-line-it-reads-not-the-the-date-of-the-day/60619>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 15, 2016, 2:58pm UTC](https://discuss.elastic.co/t/is-filebeat-able-to-index-in-elasticsearch-with-the-date-of-the-log-line-it-reads-not-the-the-date-of-the-day/60619 "2016-09-15T14:58:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Orsius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orsius/32/13646_2.png) [@Orsius](https://discuss.elastic.co/u/Orsius)\
**Post date:** [September 15, 2016, 2:58pm UTC](https://discuss.elastic.co/t/is-filebeat-able-to-index-in-elasticsearch-with-the-date-of-the-log-line-it-reads-not-the-the-date-of-the-day/60619/1 "2016-09-15T14:58:28Z")

</div>

Hello, I'm wondering if filebeat is able to index in elasticsearch with the date of the log line it reads, not the the date of the day?

- -- What I want to put in place:  
\*.log (from august 2016) \> filebeat \> elastisearch \> kibana (the goal is to see the log with the date of the event not with the day where filebeat reads the log)

- -- key points:  
I want to keep my setup as simple as possible (skip logstash step);

- -- Here is my filebeat conf file:

`filebeat:`  
`prospectors:`  
`-`  
`paths:`  
`- /applications/myapp/api*.log`  
`input_type: log`  
`exclude_lines: ["(.*)METHOD(.*)PATH(.*)health(.*)REQUEST(.*)"]`  
`multiline:`  
`pattern: "^[[:digit:]]{2}.[[:digit:]]{2}.[[:digit:]]{4}"`  
`negate: true`  
`match: after`  
`registry_file: /var/lib/filebeat/registry`  
`output:`  
`elasticsearch:`  
`hosts: ["http://elastic-01:9200", "http://elastic-02:9200" , "http://elastic-03:9200"]`  
`index: "filebeat-query-processor"`  
`template:`  
`name: "filebeat"`  
`path: "filebeat.template.json"`  
`shipper:`  
`logging:`  
`to_syslog: false`  
`to_files: true`  
`files:`  
`path: /var/log/filebeat`  
`name: filebeat-query-processor.log`  
`rotateeverybytes: 10485760 # = 10MB`  
`level: debug`  
``

Thanks in advance for your answers.

kr,  
Orsius.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 15, 2016, 6:24pm UTC](https://discuss.elastic.co/t/is-filebeat-able-to-index-in-elasticsearch-with-the-date-of-the-log-line-it-reads-not-the-the-date-of-the-day/60619/2 "2016-09-15T18:24:26Z")

</div>

Filebeat doesn't do this kind of parsing. You need Logstash for that.

---

<div class="post-metadata">

**Author:** ![Orsius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orsius/32/13646_2.png) [@Orsius](https://discuss.elastic.co/u/Orsius)\
**Post date:** [September 16, 2016, 6:42am UTC](https://discuss.elastic.co/t/is-filebeat-able-to-index-in-elasticsearch-with-the-date-of-the-log-line-it-reads-not-the-the-date-of-the-day/60619/3 "2016-09-16T06:42:40Z")

</div>

That's what I thought; Thanks for your quick answer.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [September 16, 2016, 8:02am UTC](https://discuss.elastic.co/t/is-filebeat-able-to-index-in-elasticsearch-with-the-date-of-the-log-line-it-reads-not-the-the-date-of-the-day/60619/4 "2016-09-16T08:02:10Z")

</div>

You might be interested in the elasticsearch ingest feature: [https://www.elastic.co/guide/en/elasticsearch/reference/master/grok-processor.html](https://www.elastic.co/guide/en/elasticsearch/reference/master/grok-processor.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2016, 2:58pm UTC](https://discuss.elastic.co/t/is-filebeat-able-to-index-in-elasticsearch-with-the-date-of-the-log-line-it-reads-not-the-the-date-of-the-day/60619/5 "2016-10-06T14:58:39Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.