# Issue with grok and timestamp field in apache logs

**URL:** <https://discuss.elastic.co/t/issue-with-grok-and-timestamp-field-in-apache-logs/51566>\
**Category:** Logstash\
**Created:** [June 1, 2016, 2:02pm UTC](https://discuss.elastic.co/t/issue-with-grok-and-timestamp-field-in-apache-logs/51566 "2016-06-01T14:02:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexander\_Trumper](https://avatars.discourse-cdn.com/v4/letter/a/3e96dc/32.png) [@Alexander\_Trumper](https://discuss.elastic.co/u/Alexander_Trumper)\
**Post date:** [June 1, 2016, 2:02pm UTC](https://discuss.elastic.co/t/issue-with-grok-and-timestamp-field-in-apache-logs/51566/1 "2016-06-01T14:02:51Z")

</div>

I've been going through this example:

> **[Parsing Logs with Logstash | Logstash Reference \[5.0\] | Elastic](https://www.elastic.co/guide/en/logstash/5.0/advanced-pipeline.html)**

And I used the whole config from the example (beside removing the geoip data)

> 

input {  
file {  
path =\> "/home/trueal/elk/support\_scripts/\*.log"  
start\_position =\> beginning  
ignore\_older =\> 0  
}  
}  
filter {  
grok {  
match =\> { "message" =\> "%{COMBINEDAPACHELOG}"}  
}  
}  
output {  
elasticsearch {  
hosts =\> "localhost:9200"  
}  
}

> 

While importing the data to elasticsearch works, the created mapping for the field timestamp looks like this:

```
               "timestamp": {
                    "type": "text",
                    "norms": false,
                    "fields": {
                        "raw": {
                            "type": "keyword",
                            "ignore_above": 256
                        }
                    }
                },

```

I would expect timestamp to be of type date instead of text to be able to use that field in kibana later on.  
I'm not sure if this is a bug in grok or just working as intended.

---

<div class="post-metadata">

**Author:** ![Alexander\_Trumper](https://avatars.discourse-cdn.com/v4/letter/a/3e96dc/32.png) [@Alexander\_Trumper](https://discuss.elastic.co/u/Alexander_Trumper)\
**Post date:** [June 1, 2016, 2:26pm UTC](https://discuss.elastic.co/t/issue-with-grok-and-timestamp-field-in-apache-logs/51566/2 "2016-06-01T14:26:45Z")

</div>

Ok, I quickly set up an "old" elk stack and it behaves the same, e.g. mapping timestamp to string.  
Still not very helpful, but it seems to be in grok then?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 1, 2016, 2:32pm UTC](https://discuss.elastic.co/t/issue-with-grok-and-timestamp-field-in-apache-logs/51566/3 "2016-06-01T14:32:20Z")

</div>

The grok filter will parse the timestamp as a string. You should use the [date filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) to convert this into a date, which by default will be stored in the `@timestamp` field, which in the default logstash mapping is mapped as a date.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/issue-with-grok-and-timestamp-field-in-apache-logs/51566/4 "2017-07-06T04:55:01Z")

</div>