# Logstash output incorrect time value

**URL:** https://discuss.elastic.co/t/logstash-output-incorrect-time-value/185675
**Category:** Logstash
**Created:** [June 13, 2019, 2:39pm UTC](https://discuss.elastic.co/t/logstash-output-incorrect-time-value/185675 "2019-06-13T14:39:07Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![chw4626](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@chw4626](https://discuss.elastic.co/u/chw4626)
#### Post date: [June 13, 2019, 2:39pm UTC](https://discuss.elastic.co/t/logstash-output-incorrect-time-value/185675/1 "2019-06-13T14:39:07Z")

</div>

Hi everyone,

I am try to use logstash 7.1.1 to get data from my sqlite3 db. I found an issue about the time. The time data was stored correctly in my database while it is not when using logstash.  
For example, the time data is my db is  
`SELECT modified_at from table;`

```
2019-06-13 13:33:09.325776

2019-06-12 20:57:17.207619

2019-06-12 20:58:18.758770

```

while the output shows:

```
"modified_at" => 2019-06-13T04:00:00.000Z,

"modified_at" => 2019-06-12T04:00:00.000Z,

"modified_at" => 2019-06-12T04:00:00.000Z,

```

the logstash only get the date not exact time. This is my config file:

```
input {
    jdbc {
        jdbc_driver_library => "mypath/sqlite-jdbc-3.27.2.1.jar"
        jdbc_driver_class => "org.sqlite.JDBC"
        jdbc_connection_string => "jdbc:sqlite:mypath/db.sqlite3"
        jdbc_user => ""
        tracking_column => "modified_at"
        tracking_column_type => "timestamp"
        use_column_value => true
        statement => "SELECT * from table where modified_at > :sql_last_value"
        schedule => "* * * * *"
        # clean_run => true
    }
}

filter {
  mutate {
    remove_field => ["@version","@timestamp","path","host"]
  }
}

output {
    elasticsearch {
        hosts => "localhost:9200"
        index => "test"
        document_type => "doc"
        document_id => "%{qid}"
    }
    stdout {
        codec => rubydebug
    }
}

```

And I also have a question about :sql\_last\_value.  
If tracking a time column, :sql\_last\_value will return the latest time or earliest time or multi data?

Thank you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 11, 2019, 2:39pm UTC](https://discuss.elastic.co/t/logstash-output-incorrect-time-value/185675/2 "2019-07-11T14:39:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.