# Modifying the timestamp

**URL:** <https://discuss.elastic.co/t/modifying-the-timestamp/55002>\
**Category:** Logstash\
**Created:** [July 7, 2016, 11:55pm UTC](https://discuss.elastic.co/t/modifying-the-timestamp/55002 "2016-07-07T23:55:39Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mormaii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mormaii/32/10790_2.png) [@Mormaii](https://discuss.elastic.co/u/Mormaii)\
**Post date:** [July 7, 2016, 11:55pm UTC](https://discuss.elastic.co/t/modifying-the-timestamp/55002/1 "2016-07-07T23:55:39Z")

</div>

I've got a filebeat daemon outputting logs to my redis server. My logstash is getting the input from redis and the timestamps are looking like this: "2016-07-07T23:49:19.882Z". I'm trying to modify it with this logstash filter but can't seem to make it work.

```
  filter{
      date {
          locale => "en"
          timezone => "America/Argentina/Buenos_Aires"
          match => ["timestamp", "dd/MM/yyyy:HH:mm:ss"]
      }
  bla bla bla..
  }

```

This still gets me the same timestamp and doesn't edit the formatting.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 8, 2016, 12:06am UTC](https://discuss.elastic.co/t/modifying-the-timestamp/55002/2 "2016-07-08T00:06:57Z")

</div>

What outcome are you trying to achieve here?

---

<div class="post-metadata">

**Author:** ![Mormaii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mormaii/32/10790_2.png) [@Mormaii](https://discuss.elastic.co/u/Mormaii)\
**Post date:** [July 8, 2016, 12:13am UTC](https://discuss.elastic.co/t/modifying-the-timestamp/55002/3 "2016-07-08T00:13:16Z")

</div>

I'm trying to change my timestamp from:

> 2016-07-08T00:12:19.963Z

To:

> 08/07/2016:21:12:19

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 8, 2016, 12:15am UTC](https://discuss.elastic.co/t/modifying-the-timestamp/55002/4 "2016-07-08T00:15:46Z")

</div>

Ok, the date filter just takes a given format and then tries to turn it into ISO8601 as UTC.  
It's not for changing it into a different format.

---

<div class="post-metadata">

**Author:** ![Mormaii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mormaii/32/10790_2.png) [@Mormaii](https://discuss.elastic.co/u/Mormaii)\
**Post date:** [July 8, 2016, 12:56am UTC](https://discuss.elastic.co/t/modifying-the-timestamp/55002/5 "2016-07-08T00:56:31Z")

</div>

I just tested it and even if the time is incorrect on logstash, kibana displays the time correctly. How is this achieved? Will this time difference be a problem (3 hours) if I want to use curator to delete old elastic entries?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 8, 2016, 1:01am UTC](https://discuss.elastic.co/t/modifying-the-timestamp/55002/6 "2016-07-08T01:01:30Z")

</div>

LS+ES store times in UTC.  
KB converts that to the browser timezome.

Curator also assumes UTC.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/modifying-the-timestamp/55002/7 "2017-07-06T04:49:02Z")

</div>

Closed on July 6, 2017, 4:49am UTC