# Logstash pipeline for aws cloudfront fixing timestamp issue
**URL:** https://discuss.elastic.co/t/logstash-pipeline-for-aws-cloudfront-fixing-timestamp-issue/334411
**Category:** Logstash
**Created:** [May 26, 2023, 9:38am UTC](https://discuss.elastic.co/t/logstash-pipeline-for-aws-cloudfront-fixing-timestamp-issue/334411 "2023-05-26T09:38:52Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@miiimooo](https://discuss.elastic.co/u/miiimooo)
#### Post date: [May 26, 2023, 9:38am UTC](https://discuss.elastic.co/t/logstash-pipeline-for-aws-cloudfront-fixing-timestamp-issue/334411/1 "2023-05-26T09:38:52Z")
This took me ages to figure out so I thought it might be helpful for someone else.
I'm parsing AWS CloudFront standard logs in logstash (v8.x)
The included grok pattern worked fine for me apart from the timestamp, since that uses a tab \t character to separate date and time and I couldn't get the date filter to parse that correcly.
The working solution:
```auto
filter {
grok {
match => {
"message" => "%{CLOUDFRONT_ACCESS_LOG}"
}
}
mutate {
gsub => [
"timestamp", "\t", " "
]
}
date {
locale => "en"
timezone => "UTC"
match => ["timestamp", "yyyy-MM-dd HH:mm:ss"]
target => "@timestamp"
}
geoip {
source => "[source][ip]"
target => "[client]"
}
}
```
I've also left in the geoip lookup.
If there is a better way of doing this let me know
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 23, 2023, 9:39am UTC](https://discuss.elastic.co/t/logstash-pipeline-for-aws-cloudfront-fixing-timestamp-issue/334411/2 "2023-06-23T09:39:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.