# Log with no date/time. Manual field not linking to @timestamp

**URL:** <https://discuss.elastic.co/t/log-with-no-date-time-manual-field-not-linking-to-timestamp/94160>\
**Category:** Logstash\
**Created:** [July 21, 2017, 8:03pm UTC](https://discuss.elastic.co/t/log-with-no-date-time-manual-field-not-linking-to-timestamp/94160 "2017-07-21T20:03:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blake\_2112](https://avatars.discourse-cdn.com/v4/letter/b/df705f/32.png) [@Blake\_2112](https://discuss.elastic.co/u/Blake_2112)\
**Post date:** [July 21, 2017, 8:03pm UTC](https://discuss.elastic.co/t/log-with-no-date-time-manual-field-not-linking-to-timestamp/94160/1 "2017-07-21T20:03:49Z")

</div>

I have a set of logs that I would like to input into ES and analyze. The logs are flowing into ES fine but my manual 'date' field is not properly linking to @timestamp. Thus, @timestamp is the ES ingestion time, not the date of the log itself.

```
date {
      match => ["date", "MM/dd/yyyy"]
      timezone => "America/Chicago"
      target => "@timestamp"
              }

mutate {
  add_field => ["date", "06/06/2017"]

```

Output...

```
     "@timestamp" => 2017-07-21T19:31:56.329Z,
   "Avg Dur(sec)" => 0.0,
       "@version" => "1",
           "host" => "elkTest",
           "time" => "06/06/2017",

```

"Max Avg Dur(sec)" =\> 0.0

Is this not the way to do it, is there a better way, or is the format just not matching up with @timestamp.

Any guidance would be appreciated.

---

<div class="post-metadata">

**Author:** ![jordansissel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jordansissel/32/44957_2.png) [@jordansissel](https://discuss.elastic.co/u/jordansissel)\
**Post date:** [July 21, 2017, 8:18pm UTC](https://discuss.elastic.co/t/log-with-no-date-time-manual-field-not-linking-to-timestamp/94160/2 "2017-07-21T20:18:00Z")

</div>

Your configuration and output seem in conflict, so I'm not sure what to advise --

Your config is looking for a field called "date" but your output does not have this, it has a field called "time". Perhaps this is the problem?

---

<div class="post-metadata">

**Author:** ![Blake\_2112](https://avatars.discourse-cdn.com/v4/letter/b/df705f/32.png) [@Blake\_2112](https://discuss.elastic.co/u/Blake_2112)\
**Post date:** [July 21, 2017, 8:24pm UTC](https://discuss.elastic.co/t/log-with-no-date-time-manual-field-not-linking-to-timestamp/94160/3 "2017-07-21T20:24:09Z")

</div>

You are correct....I was writing this mid-update to my config.

Thus my manual field is 'date' in which I'm attempting to populate / overwrite @timestamp.

Sorry for any confusion

@timestamp  
July 21st 2017, 15:19:19.651

t date   
06/01/2017

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 25, 2017, 9:01pm UTC](https://discuss.elastic.co/t/log-with-no-date-time-manual-field-not-linking-to-timestamp/94160/4 "2017-07-25T21:01:18Z")

</div>

Filters are evaluted in order so you need to add the field prior to the date filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2017, 9:01pm UTC](https://discuss.elastic.co/t/log-with-no-date-time-manual-field-not-linking-to-timestamp/94160/5 "2017-08-22T21:01:35Z")

</div>

Closed on August 22, 2017, 9:01pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.