# Logstash Date does not match system

**URL:** <https://discuss.elastic.co/t/logstash-date-does-not-match-system/360459>\
**Category:** Logstash\
**Created:** [May 29, 2024, 11:54am UTC](https://discuss.elastic.co/t/logstash-date-does-not-match-system/360459 "2024-05-29T11:54:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![iceman0410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iceman0410/32/134395_2.png) [@iceman0410](https://discuss.elastic.co/u/iceman0410)\
**Post date:** [May 29, 2024, 11:54am UTC](https://discuss.elastic.co/t/logstash-date-does-not-match-system/360459/1 "2024-05-29T11:54:03Z")

</div>

Hi everyone,

I have 2 logs below need to parse. The out put timestamp match time but does not match date. Can anyone help me review m logstash conf ?

Log message 1:  
[13:35:32.727:]ipr\_tcp\_open\_connect\_i(): fail opening comm channel  
Logstash conf :  
input {  
beats {  
port =\> 5044  
}  
}  
filter  
{  
grok {  
match =\> { "message" =\> "[%{TIME:dts}%{DATA:unwanted}]%{GREEDYDATA:rest}" }  
remove\_field =\> ["unwanted"]  
}  
date {  
match =\> ["dts", "HH:mm:ss.SSSS"]  
target =\> "@timestamp"  
timezone =\> "UTC"  
remove\_field =\> ["dts"]  
}  
}  
output {  
stdout {  
codec =\> rubydebug  
}  
}

Log 1 out put:

 ![D11](https://us1.discourse-cdn.com/elastic/original/3X/1/4/14888a9c4a7b93d619586cc9f983791bb6b7d9b8.png)

Log message 2:  
[30@00:01:33.048:] ===\> INFO: Next log is "/app/svacc\_pr\_ctm\_em/ctm\_em/log/cmsg\_log.CMSGATE.20220330.0", time \>00:01:33.048:\<

Logstash conf 2:  
input {  
beats {  
port =\> 5044  
}  
}  
filter  
{  
grok {  
match =\> { "message" =\> "[%{DATA:unwanted}%{TIME:dts}:]%{SPACE}===\>%{SPACE}%{LOGLEVEL:lvl}:%{SPACE}%{GREEDYDATA:rest}" }  
}  
mutate{  
remove\_field =\> ["unwanted"]  
}  
date {  
match =\> ["dts", "HH:mm:ss.SSS"]  
target =\> "@timestamp"  
timezone =\> "UTC"  
remove\_field =\> ["dts"]  
}  
}  
output {  
stdout {  
codec =\> rubydebug  
}  
}  
The out put 2:

 ![D12](https://us1.discourse-cdn.com/elastic/original/3X/2/3/234c14235e718b45a15b2d237a52ce8779572c54.png)

Out put timestamp of 2 logs should match currrent date of my machine not "2024-01-01"

Thanks everyone

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 29, 2024, 12:38pm UTC](https://discuss.elastic.co/t/logstash-date-does-not-match-system/360459/2 "2024-05-29T12:38:22Z")

</div>

> [@iceman0410](#):
>
> match =\> ["dts", "HH:mm:ss.SSSS"]

That string does not specify the year, month, or day. As a result the filter will [provide defaults](https://github.com/logstash-plugins/logstash-filter-date/issues/51) that you may not like.

---

<div class="post-metadata">

**Author:** ![iceman0410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iceman0410/32/134395_2.png) [@iceman0410](https://discuss.elastic.co/u/iceman0410)\
**Post date:** [June 1, 2024, 1:23am UTC](https://discuss.elastic.co/t/logstash-date-does-not-match-system/360459/3 "2024-06-01T01:23:17Z")

</div>

Hi, i tried config below and timestamp still get "2024-01-..." year and month should match current but it is not. Can you look at my conf please

input {  
beats {  
port =\> 5044  
}  
}  
filter {  
grok {  
match =\> {  
"message" =\> "[%{MONTHDAY:day}@%{TIME:time}:] ===\> %{LOGLEVEL:lvl}: %{GREEDYDATA:rest}"  
}  
}  
mutate {  
add\_field =\> { "dts" =\> "%{day}@%{time}" }  
remove\_field =\> ["day", "time"]  
}

```
date {
    match => ["dts", "DD@HH:mm:ss.SSS"]
    target => "@timestamp"
    timezone => "UTC"
}

```

}  
output {  
stdout {  
codec =\> rubydebug  
}  
}

Out put :  
{  
"dts" =\> "30@00:01:33.048",  
"input" =\> {  
"type" =\> "log"  
},  
"tags" =\> [  
[0] "beats\_input\_codec\_plain\_applied"  
],

```
},
      "rest" => " Next log is \"/app/svacc_pr_ctm_em/ctm_em/log/cmsg_log.CMSGATE.20220330.0\", time >00:01:33.048:<",
     "agent" => {
    "ephemeral_id" => "1b90f69c-59d4-416e-a69d-a536d6d473b0",
            "name" => "Nhan-PC",
            "type" => "filebeat",
         "version" => "8.13.2",
              "id" => "43e08710-79c0-49c9-9713-b29aa462c5d5"
},
     "event" => {
    "original" => "[30@00:01:33.048:] ===> INFO: Next log is \"/app/svacc_pr_ctm_em/ctm_em/log/cmsg_log.CMSGATE.20220330.0\", time >00:01:33.048:<"
},
  "@version" => "1",
   "message" => "[30@00:01:33.048:] ===> INFO: Next log is \"/app/svacc_pr_ctm_em/ctm_em/log/cmsg_log.CMSGATE.20220330.0\", time >00:01:33.048:<",
       "lvl" => "INFO",
       "log" => {
    "offset" => 0,
      "file" => {
        "path" => "C:\\Filebeat\\logs\\D12.txt"
    }
},
"@timestamp" => 2024-01-30T00:01:33.048Z,
       "ecs" => {
    "version" => "8.0.0"
}

```

}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 1, 2024, 2:35am UTC](https://discuss.elastic.co/t/logstash-date-does-not-match-system/360459/4 "2024-06-01T02:35:29Z")

</div>

> [@iceman0410](#):
>
> year and month should match current

Can you point to any documentation that says what the month and year will default to if they are not parsed from the date/time string? Why do you think they should match the current date?