# Problem with @timestamp

**URL:** https://discuss.elastic.co/t/problem-with-timestamp/237587
**Category:** Elasticsearch
**Created:** [June 18, 2020, 8:02am UTC](https://discuss.elastic.co/t/problem-with-timestamp/237587 "2020-06-18T08:02:28Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![Youssef\_SBAI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/youssef_sbai/32/64242_2.png) [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)
#### Post date: [June 18, 2020, 8:02am UTC](https://discuss.elastic.co/t/problem-with-timestamp/237587/1 "2020-06-18T08:02:28Z")

</div>

I use logstash for ingest in elasstic a CSV file, i have a error from the time stamps is not the daily date  
my config logstash is

```
input {

file {
    path => "/data/volumes/monitoring/logstash/logCtrlM/stock.csv"
    sincedb_path => "/dev/null"
    start_position => "beginning"
    }
}

filter {

csv {
    separator => ","
    columns => ["Univers", "Entrepot", "Sous application", "Chaine", "Job", "Statut", "couleur", "date plan", "numero passage", "satatut global", "couleurG"]
    skip_header => "true"
}

date {
    match => ["date plan" , "YYYY-MM-dd"]
    timezone => "Europe/Paris"
}

mutate {
    convert => { "numero passage" => "integer" }
}

mutate {
    convert => { "couleur" => "integer" }
}
 
mutate {
    convert => { "couleurG" => "integer" }
} 

}

output {
    elasticsearch {
    hosts => "http://elasticsearch:9200"
    index => "<logstash-{now/d}>"

       }

    stdout {
        codec => rubydebug
    }
}

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/2/726911674b2560b3d14f58e4fea336fcb1098d10.png)

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [June 18, 2020, 11:19am UTC](https://discuss.elastic.co/t/problem-with-timestamp/237587/2 "2020-06-18T11:19:45Z")

</div>

It looks good to me. Midnight in Paris is 22h00 in GMT/UTC.

---

<div class="post-metadata">

### Author: ![Youssef\_SBAI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/youssef_sbai/32/64242_2.png) [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)
#### Post date: [June 18, 2020, 11:27am UTC](https://discuss.elastic.co/t/problem-with-timestamp/237587/3 "2020-06-18T11:27:33Z")

</div>

the @timestamp " =\> 2020-06-16T22:00:00.000Z is not good is not the dailly date ?

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [June 18, 2020, 11:40am UTC](https://discuss.elastic.co/t/problem-with-timestamp/237587/4 "2020-06-18T11:40:22Z")

</div>

What do you mean by daily date? "La date du jour"?  
The date when the event happened or when logstash is running?

---

<div class="post-metadata">

### Author: ![Youssef\_SBAI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/youssef_sbai/32/64242_2.png) [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)
#### Post date: [June 18, 2020, 11:47am UTC](https://discuss.elastic.co/t/problem-with-timestamp/237587/5 "2020-06-18T11:47:07Z")

</div>

Yes it is "La date du jour"

---

<div class="post-metadata">

### Author: ![Youssef\_SBAI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/youssef_sbai/32/64242_2.png) [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)
#### Post date: [June 18, 2020, 11:49am UTC](https://discuss.elastic.co/t/problem-with-timestamp/237587/6 "2020-06-18T11:49:03Z")

</div>

for exemple my index is logstsh-2020.06.18 but the timestamp is @timestamp " =\> 2020-06-16T22:00:00.000Z

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [June 18, 2020, 12:44pm UTC](https://discuss.elastic.co/t/problem-with-timestamp/237587/7 "2020-06-18T12:44:53Z")

</div>

This is expected because you wrote this:

```auto
date {
    match => ["date plan" , "YYYY-MM-dd"]
    timezone => "Europe/Paris"
}

```

This reads the content of the text field `date plan` and parse it as a date, according the format and time zone you set and write the computed date to `@timestamp`. Which overwrites the date of the event.

Then you wrote that:

```auto
elasticsearch {
    index => "<logstash-{now/d}>"
}

```

This means that the index name is generated not by using the value of the `@timestamp` field but the current date. The default value for `index` is `logstash-%{+yyyy.MM.dd}` which uses the date of the event. See [https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-index](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-index).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 16, 2020, 12:44pm UTC](https://discuss.elastic.co/t/problem-with-timestamp/237587/8 "2020-07-16T12:44:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
