# Logstash Syslog input plugin | @timestamp issue

**URL:** <https://discuss.elastic.co/t/logstash-syslog-input-plugin-timestamp-issue/273244>\
**Category:** Logstash\
**Created:** [May 18, 2021, 7:30am UTC](https://discuss.elastic.co/t/logstash-syslog-input-plugin-timestamp-issue/273244 "2021-05-18T07:30:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stillfreem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stillfreem/32/85628_2.png) [@stillfreem](https://discuss.elastic.co/u/stillfreem)\
**Post date:** [May 18, 2021, 7:30am UTC](https://discuss.elastic.co/t/logstash-syslog-input-plugin-timestamp-issue/273244/1 "2021-05-18T07:30:07Z")

</div>

Hi, I faced a brick wall and I seem to not be able to overcome it.

## My scenario

1. FW logs coming to a server where they are caught by **Syslog-ng**
2. **Syslog-ng** passes the logs to **Logstash** on the same server
3. Currently, as a test **Logstash** writes the logs to a file.

## My problem

I can see my FW logs arriving in the following format (pasted just a single entry)

```bash
sudo tcpdump port 514 -v

```

```bash
Msg: May 18 09:11:27 somehost 1/bla/blabla/box_Firewall_Activity: +02:00 Security somehost Block: FWD|TCP|bond1.181|45.155.205.120|8080|00:00:00:00:00:00|0.0.0.0|5678|||<no-match>|1234|0.0.0.0|0.0.0.0|0|1|0|0|0|0||||||\0x0a

```

However, upon their arrival in **Logstash** (Syslog plugin) these log entries seem to have been truncated to the Time Zone and as a result @timestamp is another syslog field/property. Please check below how the message looks like

```bash
+02:00 Security somehost Block: FWD|TCP|bond1.181|45.155.205.120|8080|00:00:00:00:00:00|0.0.0.0|31900|||<no-match>|4003|0.0.0.0|0.0.0.0|0|1|0|0|0|0||||||

```

![image](https://us1.discourse-cdn.com/elastic/optimized/3X/1/0/105bb796faf255680f8a99232376082890cf2af5_2_690x19.png)

## Part of my config

```auto
input {

    syslog {
      host => "127.0.0.1"
      port => 5000
 }
}

filter {
        if [message] =~ "Security" or [message] =~ "Info" {
                #grok { keep_empty_captures => true match => { "message" => "(?....}

```

In order to parse the FW events I use grok filter that checks the syslog `message` field where raw log is (but without the timestamp which is in another syslog field `@timestamp`).  
 ![image](https://us1.discourse-cdn.com/elastic/optimized/3X/1/0/105bb796faf255680f8a99232376082890cf2af5_2_690x19.png)

My filter works as a charm but now I don't have a time stamp. The below is the content of the file where the logs are written

```auto
{"SourceIP":"0.0.0.0","ReceivedPackets":"0","Action":"Allow","Info":"0","Rule":"somerule","SentBytes":"0","L4Protocol":"UDP","SourcePort":"59839","LogLevel":"Info","DestinationIP":"10.10.20.20","DestinationPort":"53","tags":["FW_ActivityLog_IPV4","sometag"],"ReceivedBytes":"0"}

```

## My question

How can I add a timestamp to my events?

Thank you in advance for any input.

---

<div class="post-metadata">

**Author:** ![stillfreem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stillfreem/32/85628_2.png) [@stillfreem](https://discuss.elastic.co/u/stillfreem)\
**Post date:** [May 18, 2021, 11:04am UTC](https://discuss.elastic.co/t/logstash-syslog-input-plugin-timestamp-issue/273244/2 "2021-05-18T11:04:13Z")

</div>

Got it 🙂  
In my grok filter I just added `add_field => ["EventTime", "%{@timestamp}"]`

So my grok filter is  
`grok { match => { "message" => { balbalbla } add_field => ["EventTime", "%{@timestamp}"] }`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 15, 2021, 11:04am UTC](https://discuss.elastic.co/t/logstash-syslog-input-plugin-timestamp-issue/273244/3 "2021-06-15T11:04:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.