# Replace the @TimeStamp with actual time during a bulk Filebeat Send
**URL:** https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882
**Category:** Logstash
**Created:** [April 12, 2021, 1:25pm UTC](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882 "2021-04-12T13:25:18Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Wilks](https://discuss.elastic.co/u/Wilks)
#### Post date: [April 12, 2021, 1:25pm UTC](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882/1 "2021-04-12T13:25:18Z")
Hi,
We are collecting a large amount of logs through out the day and then sending them at 4:30am via Filebeat in a bulk send. The problem is when they end up in Elasticsearch/Kibana all the @TimeStamp fields are 4:30am even thought the logs have been collected at different times throughout the day. How do I set the @TimeStamp Field to what's actually in the message field.
So I want to use ""message":"03-MAR-21 02:19:42|" as the @TimeStamp instead of 4:30am.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 12, 2021, 3:29pm UTC](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882/2 "2021-04-12T15:29:10Z")
In Filebeat you could do it using a [timestamp processor](https://www.elastic.co/guide/en/beats/filebeat/current/processor-timestamp.html) (in beta), in logstash you would use a [date](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) filter.
---
### Author:  [@Wilks](https://discuss.elastic.co/u/Wilks)
#### Post date: [April 12, 2021, 11:13pm UTC](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882/3 "2021-04-12T23:13:22Z")
I think I am close but when I add the below I get date
```auto
filter
{
grok {
match => { "message" => ["%{GREEDYDATA:timestamp}\|%{IPV4:src.ip}\|%{WORD:event.id}\|%{GREEDYDATA:dn}\|%{NOTSPACE:session_id}\|%{GREEDYDATA:application_name}"] }
}
date {
match => ["timestamp", "MMM dd yyyy HH:mm:ss", "MMM d yyyy HH:mm:ss", "ISO8601"]
target => "@timestamp"
}
```
So the Filebeat always comes in as this "@timestamp":" **2021-03-04T17:17:56.133Z**", but I want to use what's in the message filed a"message": **"03-MAR-21 03:46:10**" as the @TimeStamp.
but I get "**"tags":["\_dateparsefailure"]**
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 12, 2021, 11:22pm UTC](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882/4 "2021-04-12T23:22:37Z")
ISO8601 uses a [CasualISO8601Parser](https://github.com/logstash-plugins/logstash-filter-date/blob/815a4dc7a6d718feefe6eb9e67dc5234495f298d/src/main/java/org/logstash/filters/parser/CasualISO8601Parser.java#L34) and that defers to joda for what ISO8601 means. [joda](https://github.com/JodaOrg/joda-time/blob/e37246fb936b2c242812235dff53c749e18ec200/src/main/java/org/joda/time/format/ISODateTimeFormat.java#L488) does not agree that ' 03-MAR-21 03:46:10" is ISO8601 compliant.
Just change your date filter to have the actual format
```
date { match => ["timestamp", "dd-MMM-yy HH:mm:ss"] }
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 10, 2021, 11:23pm UTC](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882/5 "2021-05-10T23:23:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.