# Logstash timestamp - not reading timestamp from log files **URL:** \ **Category:** Logstash\ **Created:** [February 19, 2016, 3:03pm UTC](https://discuss.elastic.co/t/logstash-timestamp-not-reading-timestamp-from-log-files/42256 "2016-02-19T15:03:06Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![bgrzinic](https://avatars.discourse-cdn.com/v4/letter/b/a8b319/32.png) [@bgrzinic](https://discuss.elastic.co/u/bgrzinic)\ **Post date:** [February 19, 2016, 3:03pm UTC](https://discuss.elastic.co/t/logstash-timestamp-not-reading-timestamp-from-log-files/42256/1 "2016-02-19T15:03:06Z")
Hi guys, wandering if anybody can help with advice, suggestion on configuring logstash for properly reading timestamp from custom log files. I use logstash to read custom logs and forward to Elasticssearch - in the end displaying in Kibana4, all works well except that my timestamp from log files is not read properly. When i display it in Kibana from @timestamp - it shows time when logstash read the event, and not actual timestamp from log when the event actually occurred - I assume i provided wrong timestamp format, just not sure how to change it correctly. ## Here is example from custom log file: 2016-02-19 09:02:45.103: ERROR: 24Failed to read current staging area assets: System.Data.Entity.Core.EntityException: The underlying provider failed on Open. ---\> System.Data.SqlClient.SqlException: A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - No connection could be made because the target machine actively refused it 2016-02-19 09:01:46.103: ERROR: 25Failed to read current staging area assets: System.Data.Entity.Core.EntityException: The underlying provider failed on Open. ---\> System.Data.SqlClient.SqlException: A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - No connection could be made because the target machine actively refused it 2016-02-19 09:01:47.103: ERROR: 26Failed to read current staging area assets: System.Data.Entity.Core.EntityException: The underlying provider failed on Open. ---\> System.Data.SqlClient.SqlException: A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - No connection could be made because the target machine actively refused it ## Here is my configuration logstash : file { path =\> "/Logs/\*" sincedb\_path =\> "/var/lib/logstash/.sincedb\_logs" start\_position =\> "end" type =\> customlogs stat\_interval =\> 2 } } filter { if [type] == "customlogs" and [message] =~ "ERROR:" { ``` grok { overwrite => "message" match => { "message" => "\A%{TIMESTAMP_ISO8601}: %{DATA:level} %{GREEDYDATA:message}" } } #Lets rename ":" mutate { gsub => ["level", ":",""] } ``` } else { drop { } } } output { elasticsearch { host =\> "ELK-VS-100" cluster =\> "ELK100" } stdout { codec =\> rubydebug } } Any feedback, suggestion on this is very much appreciated. Thank You very much in advanced. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [February 22, 2016, 1:31am UTC](https://discuss.elastic.co/t/logstash-timestamp-not-reading-timestamp-from-log-files/42256/2 "2016-02-22T01:31:20Z")
You need to capture the timestamp into a field using your grok pattern, and then use the [date filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) to populate the @timestamp field based on this field. ---
**Author:** ![bgrzinic](https://avatars.discourse-cdn.com/v4/letter/b/a8b319/32.png) [@bgrzinic](https://discuss.elastic.co/u/bgrzinic)\ **Post date:** [February 22, 2016, 3:25pm UTC](https://discuss.elastic.co/t/logstash-timestamp-not-reading-timestamp-from-log-files/42256/3 "2016-02-22T15:25:41Z")
Hi, yes that's what i thought - wondering if anyone can help to provide example how to catch date in format of: 2016-02-19 09:01:46.103 - from log. Can You please provide an example for this ? Thank You very much! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 22, 2016, 6:10pm UTC](https://discuss.elastic.co/t/logstash-timestamp-not-reading-timestamp-from-log-files/42256/4 "2016-02-22T18:10:09Z")
You're already using the TIMESTAMP\_ISO8601 pattern. Just capture that match into a field just like you're doing with the `level` and `message` fields. ---
**Author:** ![bgrzinic](https://avatars.discourse-cdn.com/v4/letter/b/a8b319/32.png) [@bgrzinic](https://discuss.elastic.co/u/bgrzinic)\ **Post date:** [February 23, 2016, 1:16pm UTC](https://discuss.elastic.co/t/logstash-timestamp-not-reading-timestamp-from-log-files/42256/5 "2016-02-23T13:16:51Z")
Appreciate the help. Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/logstash-timestamp-not-reading-timestamp-from-log-files/42256/6 "2017-07-06T05:10:08Z")