# Kibana custome timestamp and @timeestamp are different
**URL:** https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561
**Category:** Logstash
**Created:** [July 1, 2021, 1:23pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561 "2021-07-01T13:23:31Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 1, 2021, 1:23pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/1 "2021-07-01T13:23:31Z")
Hi Team,
I am using below xml/xpath statement to convert my string timestamp to date type timestamp in logstash
input - 2021-06-30-20:11:23
xpath - xpath =\>["concat(substring(/AdMsg/AdLels/AuditLevel/TS/text(), 1,10),'T',substring(/AdMsg/AdLels/AuditLevel/TS2text(), 12),'Z')", "PUT\_TIME"]
so my value is coming as date in kibana ,but 5:30 hrs more than current timestamp ,current timestamp is correct in field @timestamp but in my field its showing 5:30 hrs more .
logstash and kibana server timezone is IST
Please suggest method to resolve this in conf file.
---
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 1, 2021, 7:32pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/2 "2021-07-01T19:32:58Z")
Hi Team ,
Please respond.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 1, 2021, 8:04pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/3 "2021-07-01T20:04:53Z")
You have not told us what your data looks like. It is unclear if you understand that logstash and elasticsearch store dates as UTC. Are you using a date filter or are you using dynamic mapping?
---
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 1, 2021, 8:17pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/4 "2021-07-01T20:17:10Z")
Hi Badger,
my i/p is in xml and i am using xpath and string function to create date format
input -
```
2021-06-30-20:11:23
```
xpath - xpath =\>["concat(substring(/AdMsg/AdLels/AuditLevel/TS/text(), 1,10),'T',substring(/AdMsg/AdLels/AuditLevel/TS2text(), 12),'Z')", "PUT\_TIME"]
PUT\_TIME is now string like - 2021-07-02T01:39:53Z and kibana is showing this as type date - Jul 2, 2021 @ 07:09:53.000.
so this value in kibana is 5:30 hr more than current timestamp ,what need to be done to show it to timestamp same as @timestamp.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 1, 2021, 8:39pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/5 "2021-07-01T20:39:21Z")
> [@mrunalini](#):
>
> 2021-07-02T01:39:53Z
OK, the Z at the end means that that is Zulu, i.e. UTC. By default kibana will display that in your local time zone, which is five and half hours ahead of UTC. Use a date filter
```
date {
match => ["PUT_TIME", "YYYY-MM-dd'T'HH:mm:ss"]
timezone => "Asia/Kolkata"
target => "PUT_TIME"
}
```
That will change that time to 2021-07-01T20:09:53Z.
---
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 2, 2021, 3:14am UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/6 "2021-07-02T03:14:59Z")
Hi @Badger ,
Thanks for reply!!
After using this code getting - \_dateparsefailure in kibana.
in kibana @timestamp is still correct and my PUT\_TIME is %:30 hrs more .
Please suggest why its not parsing.
Thanks ,
Mrunalini
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 2, 2021, 4:01am UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/7 "2021-07-02T04:01:38Z")
You changed your xpath to stop adding the 'Z', right?
---
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 2, 2021, 7:18am UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/8 "2021-07-02T07:18:02Z")
Yes , I stopped adding Z, still facing same - \_dateparsefailure in kibana
xpath =\>["concat(substring(/AdMsg/AdLels/AuditLevel/TS/text(), 1,10),'T',substring(/AdMsg/AdLels/AuditLevel/TS/text(), 12))", "PUT\_TIME"]
---
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 2, 2021, 10:21am UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/9 "2021-07-02T10:21:44Z")
Hi @Badger /Team,
Please help with the issue .
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 2, 2021, 1:27pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/10 "2021-07-02T13:27:34Z")
Please, do not ping people or bump your post.
You need to share your logstash pipeline, without seeing your logstash pipeline is not possible to see what is wrong.
Also share the result message that give you the date parse failure.
---
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 2, 2021, 2:19pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/11 "2021-07-02T14:19:39Z")
Input -
CONSUMER\_TO\_EAI
some string
REQUEST
2021-07-02-18:23:15
and Pipeline config file as below:
input {
jms {
yaml\_file =\> "XXXX"
yaml\_section =\> "wmq"
use\_jms\_timestamp =\> false
destination =\> "Queue\_Name"
interval =\> 3
runner =\> async
```
}
```
}
filter {
xml {
store\_xml =\> false
source =\> "message"
remove\_namespaces =\> true
remove\_field =\> ["message"]
xpath =\>["/AdMsg/MtIf/msaFlowDir/text()", "SERVICE\_NAME"]
xpath =\>["/AdMsg/MtIf/level/text()", "CHANNEL\_NAME"]
xpath =\>["/AdMsg/MtIf/msaStatus/text()", "SEGMENTNAME"]
xpath =\>["concat(substring(/AdMsg/AdLels/AuditLevel/TS/text, 1,10),'T',substring(/AdMsg/AdLels/AuditLevel/TS/text(), 12))", "PUT\_TIME"]
}
if "TZ" in [PUT\_TIME]
{
```
mutate {
remove_field =>"PUT_TIME"
}
```
}
date {
match =\> ["PUT\_TIME", "yyyy-MM-dd'T'HH:mm:ss.SSS","yyyy-MM-dd'T'HH:mm:ss"]
timezone =\> "Asia/Kolkata"
target =\>["PUT\_TIME"]
}
output{
elasticsearch {
hosts =\> XXX
cacert =\> XXX
index =\> XX
```
}
```
stdout { codec =\> rubydebug }
}
---
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 2, 2021, 2:23pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/12 "2021-07-02T14:23:47Z")
Sorry xml Input not pasted correctly so added image:
---
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 5, 2021, 3:16am UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/13 "2021-07-05T03:16:01Z")
Hi Team,
Can someone please respond?
---
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 6, 2021, 10:02am UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/14 "2021-07-06T10:02:02Z")
Hello Team,
This has been pending for long now , can someone please advise
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 6, 2021, 4:00pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/15 "2021-07-06T16:00:29Z")
What is the value of [PUT\_TIME] in kibana? In Discovery, expand an event and copy and paste the value of the field from the JSON tab.
---
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 7, 2021, 8:15am UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/16 "2021-07-07T08:15:41Z")
Hi Badger,
Put time in JSON Doc is - 2021-07-07T13:44:15
but in table it shows - Jul 7, 2021 @ 19:14:15.000
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 7, 2021, 5:49pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/17 "2021-07-07T17:49:12Z")
That sounds like it is working as expected. "Jul 7, 2021 @ 19:14:15.000" is the default display format for Kibana, and it is offset from UTC by 5:30.
---
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 7, 2021, 6:14pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/18 "2021-07-07T18:14:42Z")
Hi
I want to show original date not the 5:30 hrs more .
Is it possible to do that?
---
### Author:  [@mrunalini](https://discuss.elastic.co/u/mrunalini)
#### Post date: [July 7, 2021, 6:17pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/19 "2021-07-07T18:17:32Z")
I do not have issues with the display of the time , i need it to be shown the original date ,not the 5:30 hrs more.
I there possible way to do that.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 7, 2021, 6:17pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561/20 "2021-07-07T18:17:58Z")
Elasticsearch stores the date as UTC, by default Kibana transforms that to the browser's timezone. If you want to change that reconfigure Kibana:
```
Settings -> Advanced -> DateFormat:tz
```
[Next page](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561.md?page=2)