# Looking for idea to preprocess logs

**URL:** https://discuss.elastic.co/t/looking-for-idea-to-preprocess-logs/166113
**Category:** Logstash
**Created:** [January 29, 2019, 8:41am UTC](https://discuss.elastic.co/t/looking-for-idea-to-preprocess-logs/166113 "2019-01-29T08:41:16Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [January 29, 2019, 8:45am UTC](https://discuss.elastic.co/t/looking-for-idea-to-preprocess-logs/166113/2 "2019-01-29T08:45:29Z")

</div>

Instead of pre-order the data, use the timestamp from the event and set that as the timestamp to index in elasticsearch. Then it nicely sorted in kibana when you view the data..

You can use a filter like this (this does not match your timestamp, it is just an example).

```
filter {
    grok {
        match => { "message" => "%{TIMESTAMP_ISO8601:replace_timestamp}" }
    }
    date {
      match => ['replace_timestamp', 'yyyy-MM-dd HH:mm:ss']
      timezone => "UTC"
      target => "@timestamp"
    }
}
```

---

_[View the full topic](https://discuss.elastic.co/t/looking-for-idea-to-preprocess-logs/166113)._