# Logging at past date in logstash and elasticsearch

**URL:** https://discuss.elastic.co/t/logging-at-past-date-in-logstash-and-elasticsearch/81959
**Category:** Logstash
**Created:** [April 11, 2017, 10:46am UTC](https://discuss.elastic.co/t/logging-at-past-date-in-logstash-and-elasticsearch/81959 "2017-04-11T10:46:14Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Rupesh\_Ranjan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rupesh_ranjan/32/22283_2.png) [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)
#### Post date: [April 11, 2017, 10:46am UTC](https://discuss.elastic.co/t/logging-at-past-date-in-logstash-and-elasticsearch/81959/1 "2017-04-11T10:46:14Z")

</div>

I have some logs logged at date say Apr 9, 2017. I am starting the filebeat and ELK on say 11th Apr.

Is there any way, i can log old logs at appropriate timestamp and index (i am creadting day-wise index, say test-2017.04.09, test-2017-04-10 etc.)

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 11, 2017, 11:01am UTC](https://discuss.elastic.co/t/logging-at-past-date-in-logstash-and-elasticsearch/81959/2 "2017-04-11T11:01:52Z")

</div>

If you use a date filter it'll handle it automatically.

---

<div class="post-metadata">

### Author: ![Rupesh\_Ranjan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rupesh_ranjan/32/22283_2.png) [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)
#### Post date: [April 12, 2017, 4:29am UTC](https://discuss.elastic.co/t/logging-at-past-date-in-logstash-and-elasticsearch/81959/3 "2017-04-12T04:29:33Z")

</div>

I have below config in my logstash filter

```
grok {
   match => { "message" => "%{TIMESTAMP_ISO8601:logdate}%{ISO8601_TIMEZONE:timezone} %{JAVACLASS:class} %{SYSLOG5424SD:logLevel}"}
 }
 date {
   match => ["logdate", "YYYY-MM-dd'T'HH:mm:ss.SSS"]
   target => "@timestamp"
   locale => "en"
 }

```

My log message is in this format:

> 2017-04-06T09:16:07.274-0500 c.t.i.s.b.MessageInterpreter [ERROR] message logged

I want timestamp to be **April 6th 2017, 9:16.607.274** , but it appears 5:30 hours ahead of that in kibana. The timestamp that appears there is **April 6th 2017, 14:46.607.274**

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 12, 2017, 4:49am UTC](https://discuss.elastic.co/t/logging-at-past-date-in-logstash-and-elasticsearch/81959/4 "2017-04-12T04:49:17Z")

</div>

LS assumes that time is in UTC, if it is not then you need to use the timezone option.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 10, 2017, 4:50am UTC](https://discuss.elastic.co/t/logging-at-past-date-in-logstash-and-elasticsearch/81959/5 "2017-05-10T04:50:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.