# Overwriting @timestamp in module **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [May 20, 2020, 6:08am UTC](https://discuss.elastic.co/t/overwriting-timestamp-in-module/233463 "2020-05-20T06:08:48Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mcardlesam](https://avatars.discourse-cdn.com/v4/letter/m/ee7513/32.png) [@mcardlesam](https://discuss.elastic.co/u/mcardlesam)\ **Post date:** [May 20, 2020, 6:08am UTC](https://discuss.elastic.co/t/overwriting-timestamp-in-module/233463/1 "2020-05-20T06:08:48Z")
I have written a module for filebeat to parse a log from a application I have written The pipeline mostly works, except in kibana i get the error "Text '19/May/2020 15:25:17' could not be parsed at index 12" for each record And example log entry looks like `[19/May/2020 15:25:17] INFO [module name] the log message` My pipeline file looks like ```auto { "description": "Pipeline for parsing mylogs.", "processors": [ { "grok": { "field": "message", "ignore_missing": true, "patterns": [ "\\[%{DATETIME:my.datetime}\\] %{LOGLEVEL:level} \\[%{GREEDYDATA:module}\\] %{GREEDYDATA:message}" ], "pattern_definitions": { "DATETIME": "%{MONTHDAY:day}/%{MONTH:month}/%{YEAR:year} %{TIME:time}", "GREEDYDATA": "(.|\n|\t)*" } } }, { "date": { "field": "my.datetime", "target_field": "@timestamp", "formats": ["dd/MMM/yyyy HH:mm:ss"] } } ], "on_failure": [ { "set": { "field": "error.message", "value": "{{ _ingest.on_failure_message }}" } } ] } ``` In kibanna the @timestamp is displayed as when the log was parsed by filebeat, not the timestamp of the entry. The other fields are all correctly shown in the record (ie day, month, year.. and the full datetime) In the record there is the error.message filed with `Text '19/May/2020 15:25:17' could not be parsed at index 12` I think that error message means index 12 of my format string causes an error when parsing the input? So this would be the hour? ---
**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\ **Post date:** [May 20, 2020, 10:36am UTC](https://discuss.elastic.co/t/overwriting-timestamp-in-module/233463/2 "2020-05-20T10:36:54Z")
You can try to use the Grok Debugger: [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) ---
**Author:** ![mcardlesam](https://avatars.discourse-cdn.com/v4/letter/m/ee7513/32.png) [@mcardlesam](https://discuss.elastic.co/u/mcardlesam)\ **Post date:** [May 20, 2020, 7:53pm UTC](https://discuss.elastic.co/t/overwriting-timestamp-in-module/233463/3 "2020-05-20T19:53:32Z")
The grok pattern works fine - the timestamp is correctly parsed out of my log, The issue is overriding the @timestamp filed. This should have the `my.datetime` value, but it does not ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/7/67c28315eba0d388fa402ea079dbe8aef247b044.png) ---
**Author:** ![nmoham](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@nmoham](https://discuss.elastic.co/u/nmoham)\ **Post date:** [May 20, 2020, 10:45pm UTC](https://discuss.elastic.co/t/overwriting-timestamp-in-module/233463/4 "2020-05-20T22:45:21Z")
seeing a similar issue - [Custom filebeat module timezone conversion issue](https://discuss.elastic.co/t/custom-filebeat-module-timezone-conversion-issue/233428) In my case, the timestamp is parsed and set, but the timezone always off by -8 hrs, when viewing data in Kiaban. This is definitely not related to Kibana related settings, but something inside filebeat modules. ---
**Author:** ![mcardlesam](https://avatars.discourse-cdn.com/v4/letter/m/ee7513/32.png) [@mcardlesam](https://discuss.elastic.co/u/mcardlesam)\ **Post date:** [May 20, 2020, 11:39pm UTC](https://discuss.elastic.co/t/overwriting-timestamp-in-module/233463/5 "2020-05-20T23:39:11Z")
Thanks @nmoham, reading you post helped, didnt realize I'd have to delete the pipeline in ES when changing the pipeline.yml file in filebeats. I had previously fixed a mistake in the timestamp format but that was not reflected in the pipeline in ES. To fix a used the dev-tools to run ```auto DELETE /_ingest/pipeline/filebeat-7.7.0-my-log-pipeline ``` And reparsed my logs - now the @timestamp filed is correctly set ---
**Author:** ![nmoham](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@nmoham](https://discuss.elastic.co/u/nmoham)\ **Post date:** [May 20, 2020, 11:46pm UTC](https://discuss.elastic.co/t/overwriting-timestamp-in-module/233463/6 "2020-05-20T23:46:17Z")
@mcardlesam Glad, it helped you . I am still stuck, I think the problem is when my module is sending the event, it lands into ES with UTC timezone. ```auto "message": "May 19 16:31:52 syslog tmm2[18722]: Rule /Common/IP_Reputation_Blocking_iRule : Dropping request. VS IP: 10.xxx.xx.xx, Client IP: xxx.xx.xxx.xxx, ...., "@timestamp": "2020-05-19T16:31:52.000Z", "ecs": { "version": "1.5.0" }, ``` Looked at other logs in our environment, the expectation is - ```auto "message": "May 19 16:31:52 syslog tmm2[18722]: Rule /Common/IP_Reputation_Blocking_iRule : Dropping request. VS IP: 10.xxx.xx.xx, Client IP: xxx.xx.xxx.xxx, ...., "@timestamp": "2020-05-19T23:31:52.000Z", "ecs": { "version": "1.5.0" }, ``` Also , I am routing logs to a different index using the date index Name processor. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 17, 2020, 11:50pm UTC](https://discuss.elastic.co/t/overwriting-timestamp-in-module/233463/7 "2020-06-17T23:50:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.