# Need to replace default @timestamp with userdefined timestamp

**URL:** <https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637>\
**Category:** Kibana\
**Created:** [August 29, 2017, 7:05am UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637 "2017-08-29T07:05:53Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![fazi347](https://avatars.discourse-cdn.com/v4/letter/f/b5e925/32.png) [@fazi347](https://discuss.elastic.co/u/fazi347)\
**Post date:** [August 29, 2017, 7:05am UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/1 "2017-08-29T07:05:53Z")

</div>

Hi,

I want to remove the default @timestamp entry from log messages and need to change the default log search timestamp a different one.

Kibana Version 5.5.2

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 29, 2017, 8:29am UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/2 "2017-08-29T08:29:38Z")

</div>

This is typically something you need to do when you ingest the data. What does your ingest pipeline look like?

---

<div class="post-metadata">

**Author:** ![fazi347](https://avatars.discourse-cdn.com/v4/letter/f/b5e925/32.png) [@fazi347](https://discuss.elastic.co/u/fazi347)\
**Post date:** [August 29, 2017, 8:56am UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/3 "2017-08-29T08:56:35Z")

</div>

Hi,

Setup : fluentd, elasticsearch and kibana are using to collect and display the logs from client nodes.  
Logs includes each node name,timestamp at which the logs are generated in nodes and error message.  
The logs displaying with kibana should be listed based on the timestamp sending from client node.

I have written fluentd code for sending and receiving logs. But i haven't done anything in kibana end.. its showing default items.

Thanks..

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 29, 2017, 11:18am UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/4 "2017-08-29T11:18:39Z")

</div>

I suspect you may need to alter your fluentd processing to ensure the events are written into Elasticsearch with the right data and format. It may be easier if you show what the events look like and what you expect, although I have never used fluentd, so may not be able to help.

---

<div class="post-metadata">

**Author:** ![fazi347](https://avatars.discourse-cdn.com/v4/letter/f/b5e925/32.png) [@fazi347](https://discuss.elastic.co/u/fazi347)\
**Post date:** [August 29, 2017, 11:22am UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/5 "2017-08-29T11:22:21Z")

</div>

The conf in fluentd are wring the required data only(if writing to a file) but when displaying in kibana there is one more additional value @timestamp and this is the default value in kibana i think. i need to remove this entry.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 29, 2017, 11:23am UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/6 "2017-08-29T11:23:28Z")

</div>

I am not sure I understand. Can you please provide an example of an event and what you want it to look like?

---

<div class="post-metadata">

**Author:** ![fazi347](https://avatars.discourse-cdn.com/v4/letter/f/b5e925/32.png) [@fazi347](https://discuss.elastic.co/u/fazi347)\
**Post date:** [August 29, 2017, 11:52am UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/7 "2017-08-29T11:52:29Z")

</div>

Example: Current o/p displaying in kibana as below:  
2017-08-29T14:40:40+03:00 { "log\_id": 24, "server\_name": "node1", "time\_stamp": "2017-08-29 11:40:01 +0300", "issue\_category": "File systems issues / not mounted properly", "issue": "filesystem is full", "arguments": "/tmp usage crossed threshold by utilizing 15 ", "@timestamp": "2017-08-29T14:40:40+03:00" }

Here @timestamp is default time stamp in kibana  
time\_stamp is the time stamp from node when generating log.

I need only time\_stamp (generated from nodes), need to remove @timestamp . Also the searching in kibana is now using default @timestamp(first entry in example) this also need to replace with time\_stamp .

---

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [August 29, 2017, 12:14pm UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/8 "2017-08-29T12:14:26Z")

</div>

@fazi347:  
If you don't alter @timestamp, then @timestamp is the date of insertion into elastic.

You can always put `time_stamp` into @timestamp and remove your `time_stamp`.

Other option is to leave it as is and just set kibana to use your time\_stamp for display.

I'm using `date` field for this. Just go into kibana settings and set the `timelion:es.timefield` to your `time_stamp`

---

<div class="post-metadata">

**Author:** ![fazi347](https://avatars.discourse-cdn.com/v4/letter/f/b5e925/32.png) [@fazi347](https://discuss.elastic.co/u/fazi347)\
**Post date:** [August 29, 2017, 12:56pm UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/9 "2017-08-29T12:56:05Z")

</div>

> [@Mojster](#):
>
> put time\_stamp into @timestamp

Hi,  
thanks ..

Could you please explain how to put time\_stamp into @timestamp.

---

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [August 29, 2017, 1:08pm UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/10 "2017-08-29T13:08:27Z")

</div>

```auto
date {
		locale => "en"
		match => ["time_stamp", "dd.MM.YYYY HH:mm:ss"]
		timezone => "Europe/Ljubljana"
		target => "@timestamp"
		remove_field = > ['time_stamp']
	}

```

If you want both timestamps leave out the remove part.

---

<div class="post-metadata">

**Author:** ![fazi347](https://avatars.discourse-cdn.com/v4/letter/f/b5e925/32.png) [@fazi347](https://discuss.elastic.co/u/fazi347)\
**Post date:** [August 29, 2017, 1:36pm UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/11 "2017-08-29T13:36:13Z")

</div>

Thank you.. will check this.

---

<div class="post-metadata">

**Author:** ![fazi347](https://avatars.discourse-cdn.com/v4/letter/f/b5e925/32.png) [@fazi347](https://discuss.elastic.co/u/fazi347)\
**Post date:** [August 30, 2017, 5:45am UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/12 "2017-08-30T05:45:29Z")

</div>

Please let me know were should i add this date entry..?  
in fluentd/logstash conf file or kibana conf file or elasticsearch ?

Thanks..

---

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [August 30, 2017, 6:10am UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/13 "2017-08-30T06:10:31Z")

</div>

In your pipeline, that your using in LS.

Kibana is just for display & monitor.

---

<div class="post-metadata">

**Author:** ![fazi347](https://avatars.discourse-cdn.com/v4/letter/f/b5e925/32.png) [@fazi347](https://discuss.elastic.co/u/fazi347)\
**Post date:** [August 30, 2017, 1:45pm UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/14 "2017-08-30T13:45:11Z")

</div>

thank you..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2017, 1:45pm UTC](https://discuss.elastic.co/t/need-to-replace-default-timestamp-with-userdefined-timestamp/98637/15 "2017-09-27T13:45:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.