# Logstash logs isn't like according to its date when see in kibana?

**URL:** <https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924>\
**Category:** Logstash\
**Created:** [October 5, 2020, 5:13am UTC](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924 "2020-10-05T05:13:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bhavin\_Varsur](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\
**Post date:** [October 5, 2020, 5:13am UTC](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924/1 "2020-10-05T05:13:29Z")

</div>

i'm using logstash v7.9.2.  
i have logs which are day wise like  
log-2020.10.03,  
log-2020.10.04,  
log-2020.10.05  
it mixed up everything .i want to separate logs in separate index (daywise log).  
but i seeing logs of 3rd October in log-2020.10.05 index.  
How can I separate them ?

 ![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e5a55dcfb681b5f55208636253665c0f5fe37878.png)

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [October 5, 2020, 5:52am UTC](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924/2 "2020-10-05T05:52:35Z")

</div>

Hi,

By default logstash adds the date and time of the ingest operation as @timestamp which is shown as time in your screenshot. To solve this use the [time filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) to parse your timestamp field into @timestamp.

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![Bhavin\_Varsur](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\
**Post date:** [October 5, 2020, 6:06am UTC](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924/3 "2020-10-05T06:06:46Z")

</div>

How can I parse this 2020-10-05 11:32:14.4851 type of date format

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [October 5, 2020, 6:16am UTC](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924/4 "2020-10-05T06:16:36Z")

</div>

The definition is on the same page:

- yyyy - full year
- MM - 2-digit month
- dd - 2-digit day
- HH - two-digit hour
- mm - 2-digit minutes
- ss - 2-digit seconds
- SSS - thousands of a second

so your filter would be:

```auto
filter {
      date {
        match => ["logdate", "yyyy-MM-dd HH:mm:ss.SSS"]
      }
    }

```

---

<div class="post-metadata">

**Author:** ![Bhavin\_Varsur](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\
**Post date:** [October 5, 2020, 6:22am UTC](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924/5 "2020-10-05T06:22:48Z")

</div>

It works ,Thank you so much !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 2, 2020, 6:22am UTC](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924/6 "2020-11-02T06:22:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.