# Parse date from @timestamp

**URL:** <https://discuss.elastic.co/t/parse-date-from-timestamp/361721>\
**Category:** Logstash\
**Created:** [June 19, 2024, 9:48am UTC](https://discuss.elastic.co/t/parse-date-from-timestamp/361721 "2024-06-19T09:48:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![TasK](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/task/32/124057_2.png) [@TasK](https://discuss.elastic.co/u/TasK)\
**Post date:** [June 19, 2024, 9:48am UTC](https://discuss.elastic.co/t/parse-date-from-timestamp/361721/1 "2024-06-19T09:48:41Z")

</div>

Hello,

I'm trying to replace the date in kibana with the date from the logfile, which gets pre-parsed with the json parser from filebeat and looks like this:

```auto
{
    "@timestamp": "2024-06-19T10:00:00.469Z",
    "log.level": "WARN",
    "message": "xxx"
}

```

For some reasons, the date filter fails:

```auto
date {
    match => ["@timestamp", "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"]
    tag_on_failure => "_dateparsefailure_x"
    add_tag => ["date_replaced"]
}

```

The @timestamp in kibana still isn't the timestamp from the file. Any ideas why?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 19, 2024, 10:49am UTC](https://discuss.elastic.co/t/parse-date-from-timestamp/361721/2 "2024-06-19T10:49:11Z")

</div>

What does the event look like if you use `output { stdout { codec => rubydebug } }` (specifically, are there quotes around the value of @timestamp)? What value do you see for @timestamp in Kibana for that event?

---

<div class="post-metadata">

**Author:** ![TasK](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/task/32/124057_2.png) [@TasK](https://discuss.elastic.co/u/TasK)\
**Post date:** [June 19, 2024, 11:17am UTC](https://discuss.elastic.co/t/parse-date-from-timestamp/361721/3 "2024-06-19T11:17:35Z")

</div>

Unfortunately, I can't change the outpout right now.

Yes, there are quotes around the value as shown in my first post. The value in Kibana is a few minutes later. I assume it's the timestamp when logstash first saw the event.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 19, 2024, 11:27am UTC](https://discuss.elastic.co/t/parse-date-from-timestamp/361721/4 "2024-06-19T11:27:07Z")

</div>

> [@TasK](#):
>
> Yes, there are quotes around the value as shown in my first post.

That's JSON, not rubydebug. What does it look like in rubydebug output?