# Logstash timestamp/time/date problems
**URL:** https://discuss.elastic.co/t/logstash-timestamp-time-date-problems/79753
**Category:** Logstash
**Created:** [March 23, 2017, 1:18pm UTC](https://discuss.elastic.co/t/logstash-timestamp-time-date-problems/79753 "2017-03-23T13:18:52Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@hologram](https://discuss.elastic.co/u/hologram)
#### Post date: [March 23, 2017, 1:18pm UTC](https://discuss.elastic.co/t/logstash-timestamp-time-date-problems/79753/1 "2017-03-23T13:18:52Z")
Hi all I need some help.
I set my first elk this morning . I used this tutorial. [https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7)
At the end I want my websphere logs to go to logstash but first syslog has to work fine.
Now logstash is receiving input but I have few problems.
First the known problem with changing logstash timestamp with real timestamp from log file. I googled a lot but cant figure this out.
This is my syslog filter
```
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => ["received_at", "%{@timestamp}"]
add_field => ["received_from", "%{host}"]
}
syslog_pri { }
date {
match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
}
```
Log sample from client
`Mar 23 11:12:00 hostname systemd: Starting Session 2 of user root`
Locale the same on both
Second problem is that log order is messed up.
This is kibana view.
Mar 23 13:01:01 hostname systemd: Started Session 5 of user root.
Mar 23 13:01:01 hostname systemd: Starting Session 5 of user root.
Mar 23 12:15:12 hostname journal: root[/root] 56092 ipaddress 22: tail -f /var/log/messages
Mar 23 12:15:14 hostname journal: root[/root] 56092 ipaddress 22: locale
Mar 23 12:10:17 hostname journal: root[/root] 56092 ipaddress 22: tail -f /var/log/messages
Mar 23 12:10:23 hostname journal: root[/root] 56092 ipaddress 22: tail -f /var/log/secure
You can see wrong time order, Order in log file on client i as it should be.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 23, 2017, 1:43pm UTC](https://discuss.elastic.co/t/logstash-timestamp-time-date-problems/79753/2 "2017-03-23T13:43:57Z")
Please show what an example event looks like. Copy/paste from Kibana's JSON tab. No screenshot.
---
### Author:  [@hologram](https://discuss.elastic.co/u/hologram)
#### Post date: [March 23, 2017, 1:54pm UTC](https://discuss.elastic.co/t/logstash-timestamp-time-date-problems/79753/3 "2017-03-23T13:54:06Z")
{
"\_index": "filebeat-2017.03.23",
"\_type": "log",
"\_id": "AVr7VWS9vp0eQ-kwixiE",
"\_score": null,
"\_source": {
"@timestamp": "2017-03-23T13:22:36.001Z",
"offset": 564659,
"@version": "1",
"input\_type": "log",
"beat": {
"hostname": "myserver",
"name": "myserver",
"version": "5.2.2"
},
"host": "myserver",
"source": "/var/log/messages",
"message": "Mar 23 14:22:27 myserverjournal: root[/root] ipaddress 54723 ipaddress 22: timedatectl",
"type": "log",
"tags": [
"beats\_input\_codec\_plain\_applied"
]
},
"fields": {
"@timestamp": [
1490275356001
]
},
"sort": [
1490275356001
]
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 23, 2017, 1:58pm UTC](https://discuss.elastic.co/t/logstash-timestamp-time-date-problems/79753/4 "2017-03-23T13:58:47Z")
That event has the type "log" and not "syslog" so your filters are never applied.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 20, 2017, 1:59pm UTC](https://discuss.elastic.co/t/logstash-timestamp-time-date-problems/79753/5 "2017-04-20T13:59:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.