# New help assigning a date to @timestamp
**URL:** https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107
**Category:** Logstash
**Created:** [November 9, 2017, 9:11pm UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107 "2017-11-09T21:11:19Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@mhallman](https://discuss.elastic.co/u/mhallman)
#### Post date: [November 9, 2017, 9:11pm UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107/1 "2017-11-09T21:11:19Z")
Hello,
NOOB here. Trying to assign a date that I have constructed from other fields in a csv to @timestamp. The field that is concatenated shows up in the imported data but I can get it into the @timestamp field. Here is the conf file segment.
Thanks for any advice you may be able to provide.
-Mark
filter {
if [type] == "l2tcsv" {
csv {
separator =\> ","
quote\_char =\> "ยช" # workaround: don't use a quote character as " gives issues if the field contains a "
columns =\> ["date","time","timezone","short"]
}
if [date] == "date" {
drop {} # drop the first line that contains the column names
}
mutate { merge =\> ["date", "time"] } # merge and join need to be in separate mutates
mutate { merge =\> ["date", "timezone"] } # merge and join need to be in separate mutates
mutate { join =\> ["date", " "] } # merge and join need to be in separate mutates
date {
match =\> ["date", "MM/dd/YYYY HH:mm:ss z"]
# target =\> "date"
```
}
```
}
}
What I get is two separate fields:
1. @timestamp - the date load time
2. date - which is the concatenation of the date, time, and timezone. I want that value in @timestamp
3. short
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 9, 2017, 9:43pm UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107/2 "2017-11-09T21:43:22Z")
> date - which is the concatenation of the date, time, and timezone. I want that value in @timestamp
Then remove `target => "date"` in your date filter.
---
### Author:  [@mhallman](https://discuss.elastic.co/u/mhallman)
#### Post date: [November 9, 2017, 9:59pm UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107/3 "2017-11-09T21:59:56Z")
Magnus,
Thanks for your reply. That line is commented out so I don't think it is
impacting anything but I will remove it anyway.
```
date {
match => ["date", "MM/dd/YYYY HH:mm:ss z"]
```
# target =\> "date"
```
}
```
Do you see anything else that could be affecting it?
Thanks,
-Mark
mobile:830.255.1551
Skype: mhallman
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 9, 2017, 10:03pm UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107/4 "2017-11-09T22:03:47Z")
> That line is commented out
_Always_ format configuration and log snippets as preformatted text.
> Do you see anything else that could be affecting it?
Please show an example event produced by Logstash. Use a `stdout { codec => rubydebug }` output.
---
### Author:  [@mhallman](https://discuss.elastic.co/u/mhallman)
#### Post date: [November 9, 2017, 10:56pm UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107/5 "2017-11-09T22:56:05Z")
> {
> "date" =\> "06/18/2016 02:29:52 UCT",
> "path" =\> "/home/analyst/test-data/test.csv",
> "@timestamp" =\> 2017-11-09T22:54:43.404Z,
> "timezone" =\> "UCT",
> "@version" =\> "1",
> "host" =\> "ubuntu",
> "short" =\> "URL: Cookie:pc [user@www.radiorage.com](mailto:user@www.radiorage.com)/",
> "time" =\> "02:29:52",
> "message" =\> "06/18/2016,02:29:52,UCT,URL: Cookie:pc [user@www.radiorage.com](mailto:user@www.radiorage.com)/",
> "type" =\> "l2tcsv",
> "tags" =\> [
> [0] "\_dateparsefailure"
> ]
> }
> {
> "date" =\> "06/18/2016 02:32:41 UCT",
> "path" =\> "/home/analyst/test-data/test.csv",
> "@timestamp" =\> 2017-11-09T22:54:43.404Z,
> "timezone" =\> "UCT",
> "@version" =\> "1",
> "host" =\> "ubuntu",
> "short" =\> "URL: Cookie:pc [user@eclkmpsa.com](mailto:user@eclkmpsa.com)/adServe",
> "time" =\> "02:32:41",
> "message" =\> "06/18/2016,02:32:41,UCT,URL: Cookie:pc [user@eclkmpsa.com](mailto:user@eclkmpsa.com)/adServe",
> "type" =\> "l2tcsv",
> "tags" =\> [
> [0] "\_dateparsefailure"
> ]
> }
> {
> "date" =\> "06/18/2016 04:00:00 UCT",
> "path" =\> "/home/analyst/test-data/test.csv",
> "@timestamp" =\> 2017-11-09T22:54:43.407Z,
> "timezone" =\> "UCT",
> "@version" =\> "1",
> "host" =\> "ubuntu",
> "short" =\> "[Empty description] D:\Nondeflagellated Cultures.xlsx",
> "time" =\> "04:00:00",
> "message" =\> "06/18/2016,04:00:00,UCT,[Empty description] D:\Nondeflagellated Cultures.xlsx",
> "type" =\> "l2tcsv",
> "tags" =\> [
> [0] "\_dateparsefailure"
> ]
> }
---
### Author:  [@mhallman](https://discuss.elastic.co/u/mhallman)
#### Post date: [November 9, 2017, 10:57pm UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107/6 "2017-11-09T22:57:27Z")
I heard you about the preformatted text and thought I did it. Sorry if it did not come out that way.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 9, 2017, 11:06pm UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107/7 "2017-11-09T23:06:44Z")
[As documented](http://www.joda.org/joda-time/key_format.html), time zone names can't be parsed. Is the time zone always UCT? If so use the date filter's `timezone` option.
---
### Author:  [@mhallman](https://discuss.elastic.co/u/mhallman)
#### Post date: [November 11, 2017, 3:28pm UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107/8 "2017-11-11T15:28:12Z")
Magnus,
Unfortunately, the timezone is variable.
-mh
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 13, 2017, 6:23am UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107/9 "2017-11-13T06:23:00Z")
Then you have two options:
- Use a translate filter to, er, translate the time zone names into time zone offsets that the date filter accepts.
- Put the time zone name in a field of its own and reference it in the `timezone` option of the date filter. This assumes that the time zone names being used are unambiguous and acceptable to the date filter (the filter documentation links to a table of supported time zone names).
---
### Author:  [@mhallman](https://discuss.elastic.co/u/mhallman)
#### Post date: [November 13, 2017, 1:37pm UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107/10 "2017-11-13T13:37:06Z")
Magnus,
I have a field in my csv, "l2t\_timezone", but I am not having any luck
assigning is to timezone.
I have tried various ways like timezone =\> "l2t\_timezone" with no success.
I have verified that the timezone names are supported. The timezone name
in my test data is "UCT".
Can you tell me how I would make that assignment?
Thank you.
-Mark
mobile:830.255.1551
Skype: mhallman
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 13, 2017, 2:41pm UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107/11 "2017-11-13T14:41:25Z")
`timezone => "%{l2t_timezone}"`, see [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 11, 2017, 2:41pm UTC](https://discuss.elastic.co/t/new-help-assigning-a-date-to-timestamp/107107/12 "2017-12-11T14:41:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.