# Logstash KV plugin, convert string values to timestamp **URL:** \ **Category:** Logstash\ **Created:** [September 8, 2017, 5:23am UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791 "2017-09-08T05:23:24Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![shashwat](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@shashwat](https://discuss.elastic.co/u/shashwat)\ **Post date:** [September 8, 2017, 5:23am UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/1 "2017-09-08T05:23:24Z")
Hi, I am using Logstash 5.5 to parse my logs. I have following format of the logs: time taken for doing transfer once for all files in seconds=23 transfer start time= 201708030959 transfer end time = 201708030959. I am using KV plugin to get the key/value pair from this file. I want to convert received "time" key's value "201708030959" to actual timestamp. I am using following configuration: filter { kv { allow\_duplicate\_values =\> false trim\_key =\> "\s" value\_split =\> "=" } date { match =\> ["time","YYYYMMddHHmm"] } } But , it does not convert "time" to date/timestamp when I check in Kibana. It keeps it as String. Please let me know how can I convert this string time value to actual timestamp? Thanks, ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 8, 2017, 8:29am UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/2 "2017-09-08T08:29:33Z")
Your date filter doesn't convert the `time` field. It parses that field and stores the resulting timestamp in the `@timestamp` field. Secondly, even if you configure the date filter to store the result in the `time` field that field will already have been mapped as a string so you need to reindex or create a new index for it to be mapped as a timestamp. ---
**Author:** ![shashwat](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@shashwat](https://discuss.elastic.co/u/shashwat)\ **Post date:** [September 8, 2017, 8:45am UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/3 "2017-09-08T08:45:53Z")
Hi Magnus, Thanks for replying. If I am getting it correctly, should I refer @timestamp field in my date filter like : date { match =\> ["@timestamp","YYYYMMddHHmm"] } OR, something like this date { match =\> ["time","YYYYMMddHHmm"] target =\> "@timestamp" remove\_field =\> ["time"] } Thanks. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 8, 2017, 8:47am UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/4 "2017-09-08T08:47:31Z")
The latter. ---
**Author:** ![shashwat](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@shashwat](https://discuss.elastic.co/u/shashwat)\ **Post date:** [September 8, 2017, 12:00pm UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/5 "2017-09-08T12:00:28Z")
Hi Magnus, Thanks, that worked. I can see the @timestamp mapped to "time" field in Kibana. Only difference is between the time written in the logs and displaying on Kibana GUI. e.g time taken for doing transfer once for all files in seconds=30 transfer start time= 20170803 **1000** transfer end time = 20170803 **1000** But on Kibana , it is shown as : @timestamp August 3rd 2017, **20:30:00.000** So, date is correct but time is not the same. Is it due to my local timzone in which my browser is running? Can I make any changes to configuration to keep this time in sync? Thanks, ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 8, 2017, 1:31pm UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/6 "2017-09-08T13:31:16Z")
The `@timestamp` field is always UTC but Kibana does by default adapt it to the browser's local timezone. What timezone is 201708031000 in? What's the raw and inadjusted `@timestamp` value (use Kibana's JSON tab)? ---
**Author:** ![shashwat](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@shashwat](https://discuss.elastic.co/u/shashwat)\ **Post date:** [September 8, 2017, 2:03pm UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/7 "2017-09-08T14:03:00Z")
Hi Magnus, It is CDT (Central day light time) and it is 10:30 hours behind my current location (New Delhi). I think, it is the same difference I see in Kibana. Following is Kibana's JSON tab: { "\_index": "logs\_output", "\_type": "logs\_output", "\_id": "AV5hVygPhhnM7015uVjd", "\_version": 1, "\_score": null, "\_source": { "path": "/var/opt/logs/ELK/applog\_output.log", "seconds": "23", "@timestamp": "2017-08-03T14:59:00.000Z", "@version": "1", "host": "serv231-mgmt", "message": "time taken for doing transfer once for all files in seconds=23 transfer start time= 201708030959 transfer end time = 201708030959" }, "fields": { "@timestamp": [ 1501772340000 ] }, "sort": [ 1501772340000 ] } Thanks, ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 8, 2017, 2:36pm UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/8 "2017-09-08T14:36:28Z")
If 201708031000 is CDT and gets turned into 2017-08-03T15:00:00.000Z in `@timestamp` which is then displayed as Aug 3, 2017 at 20:30 local time for you then everything is working as expected. ---
**Author:** ![shashwat](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@shashwat](https://discuss.elastic.co/u/shashwat)\ **Post date:** [September 8, 2017, 2:55pm UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/9 "2017-09-08T14:55:59Z")
Thanks Magnus helping me out. ---
**Author:** ![shashwat](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@shashwat](https://discuss.elastic.co/u/shashwat)\ **Post date:** [September 12, 2017, 3:08pm UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/10 "2017-09-12T15:08:43Z")
Hi Magnus, Is there a way in logstash where I can have more than one @timestamp attribute mapped with corresponding "time" keys in the logs? e.g. I have two different "time" keys in a log line, time="value1" and time="value2". For the same value (value1=value2) it works fine but for different time values above configuration does not work correctly. Thanks, ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 13, 2017, 11:26am UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/11 "2017-09-13T11:26:58Z")
You can have any number of timestamp fields. The date filter has a `target` option that allows you to choose where the parsed timestamp is stored. ---
**Author:** ![shashwat](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@shashwat](https://discuss.elastic.co/u/shashwat)\ **Post date:** [September 13, 2017, 4:41pm UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/12 "2017-09-13T16:41:54Z")
Thanks Magnus. I am able to solve it now. Thanks for the guidance. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 11, 2017, 4:42pm UTC](https://discuss.elastic.co/t/logstash-kv-plugin-convert-string-values-to-timestamp/99791/13 "2017-10-11T16:42:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.