# Logstash change default @timestamp value by field from mongo

**URL:** <https://discuss.elastic.co/t/logstash-change-default-timestamp-value-by-field-from-mongo/225911>\
**Category:** Logstash\
**Created:** [March 31, 2020, 4:20pm UTC](https://discuss.elastic.co/t/logstash-change-default-timestamp-value-by-field-from-mongo/225911 "2020-03-31T16:20:20Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![7cinquante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/7cinquante/32/65338_2.png) [@7cinquante](https://discuss.elastic.co/u/7cinquante)\
**Post date:** [March 31, 2020, 4:20pm UTC](https://discuss.elastic.co/t/logstash-change-default-timestamp-value-by-field-from-mongo/225911/1 "2020-03-31T16:20:20Z")

</div>

Hello, I would like get @timestamp to be my mongo field "created\_at", i do

```auto
input {
		jdbc {
			 jdbc_driver_library => "/usr/share/logstash/logstash-core/lib/jars/mongojdbc1.8.jar"
			 jdbc_driver_class => "com.dbschema.MongoJdbcDriver"
			 jdbc_connection_string => "jdbc:mongodb://0.0.0:27018/toto"
			 jdbc_validate_connection => true
			 jdbc_user => ""
			 jdbc_password => ""
			 schedule => "/15 * * * * *"
			 tracking_column => "created_at"
       tracking_column_type => "timestamp"
			 statement => "db.getCollection('people').aggregate([
			 		{ $project: {
'_id': {$toString: '$_id'},
'name' : 1,
'gender' : 1,
'birthDate' : 1,
'type' : 1,
'origin' : 1,
'created_at' : 1,
'updated_at' : 1
						}
					}
					]);"
			 }
}

filter{
			mutate {
			    convert => { "created_at" => "string" }
			  }
			date {
				match => ["created_at", "yyyy-MM-dd'T'HH:mm:ss'.'SSS'Z'"]
				target => "@timestamp"
			}
}

output {
	elasticsearch {
		hosts => "elasticsearch:9200"
		user => "elastic"
		password => "changeme"
		index => "pdn_test_people_tt"
		document_id => "%{_id}"
	}
	stdout { codec => rubydebug }
}

```

No result @timestamp is alway date Now.  
Thanks for your help

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 31, 2020, 6:34pm UTC](https://discuss.elastic.co/t/logstash-change-default-timestamp-value-by-field-from-mongo/225911/2 "2020-03-31T18:34:36Z")

</div>

What does a document look like on the JSON tab of an expanded event in Kibana? Specifically the created\_at field.

---

<div class="post-metadata">

**Author:** ![7cinquante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/7cinquante/32/65338_2.png) [@7cinquante](https://discuss.elastic.co/u/7cinquante)\
**Post date:** [March 31, 2020, 7:02pm UTC](https://discuss.elastic.co/t/logstash-change-default-timestamp-value-by-field-from-mongo/225911/3 "2020-03-31T19:02:24Z")

</div>

the stdOut from logstash

```auto
{
     "@timestamp" => 2020-03-31T18:53:15.696Z,
       "document" => {
               "name" => "test-kibana",
         "created_at" => 2020-03-30T13:59:09.608Z,
          "birthDate" => "1983",
               "type" => "Adulte",
             "gender" => "homme",
             "origin" => "Lors d'une intervention extérieure",
                "_id" => "5e81fb2ded73c60028bf2f54"
     }, "@version" => "1"
}

```

and the json in Kibana discover

```auto
{
  "_index": "pdn_test_people_tt",
  "_type": "_doc",
  "_id": "%{_id}",
  "_version": 57996,
  "_score": null,
  "_source": {
    "document": {
      "origin": "Lors d'une intervention extérieure",
      "name": "test-kibana",
      "birthDate": "1983",
      "_id": "5e81fb2ded73c60028bf2f54",
      "gender": "homme",
      "type": "Adulte",
      "created_at": "2020-03-30T13:59:09.608Z"
    },
    "@version": "1",
    "@timestamp": "2020-03-31T19:01:00.686Z"
  },
  "fields": {
    "@timestamp": [
      "2020-03-31T19:01:00.686Z"
    ],
    "document.created_at": [
      "2020-03-30T13:59:09.608Z"
    ]
  },
  "sort": [
    1585681260686
  ]
}

```

thanks

---

<div class="post-metadata">

**Author:** ![7cinquante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/7cinquante/32/65338_2.png) [@7cinquante](https://discuss.elastic.co/u/7cinquante)\
**Post date:** [March 31, 2020, 7:05pm UTC](https://discuss.elastic.co/t/logstash-change-default-timestamp-value-by-field-from-mongo/225911/4 "2020-03-31T19:05:43Z")

</div>

> [@7cinquante](#):
>
> "2020-03-30T13:59:09.608Z"

and i have only 3 hits on 1 years , i'm waiting for 108 hit ???

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 31, 2020, 8:40pm UTC](https://discuss.elastic.co/t/logstash-change-default-timestamp-value-by-field-from-mongo/225911/5 "2020-03-31T20:40:14Z")

</div>

You do not have a field called [created\_at]

You have a field called [document][created\_at]

---

<div class="post-metadata">

**Author:** ![7cinquante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/7cinquante/32/65338_2.png) [@7cinquante](https://discuss.elastic.co/u/7cinquante)\
**Post date:** [March 31, 2020, 10:07pm UTC](https://discuss.elastic.co/t/logstash-change-default-timestamp-value-by-field-from-mongo/225911/6 "2020-03-31T22:07:14Z")

</div>

thanks your 're right .

who add this, logstash or my mongo request ?  
is this the reason why i only have one doc in ES ?

thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 31, 2020, 11:07pm UTC](https://discuss.elastic.co/t/logstash-change-default-timestamp-value-by-field-from-mongo/225911/7 "2020-03-31T23:07:51Z")

</div>

Having never used Mongo I am unable to answer your additional questions.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2020, 11:07pm UTC](https://discuss.elastic.co/t/logstash-change-default-timestamp-value-by-field-from-mongo/225911/8 "2020-04-28T23:07:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.