# Replace timestamp by a other field **URL:** \ **Category:** Logstash\ **Created:** [July 10, 2017, 2:20pm UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488 "2017-07-10T14:20:17Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![FR-TheS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fr-thes/32/17396_2.png) [@FR-TheS](https://discuss.elastic.co/u/FR-TheS)\ **Post date:** [July 10, 2017, 2:20pm UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488/1 "2017-07-10T14:20:17Z")
Hello everybody, I know this subject is asked many time but after many try, I don't understand some things... Here is my data input > "@timestamp" =\> 2017-07-10T14:12:01.442Z, > "data\_completiondate" =\> 2017-07-01T02:02:35.610Z, > "xdateinserted" =\> 2017-07-01T00:00:10.153Z, Here is my filter logstash cfg > ``` > filter { > date { > match => ["xdateinserted" , "yyyy-MM-dd'T'HH:mm:ss.SSSZ"] > } > } > > ``` I got a [0] "\_dateparsefailure" and don't understand why because my match seems ok for me. I've tried ISO8601 too. ---
**Author:** ![FR-TheS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fr-thes/32/17396_2.png) [@FR-TheS](https://discuss.elastic.co/u/FR-TheS)\ **Post date:** [July 10, 2017, 3:54pm UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488/2 "2017-07-10T15:54:37Z")
I have follow the guide : [https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) and got the same result with ``` > input { > stdin {} > } > filter { > date { > match => ["message", "MMM dd HH:mm:ss"] > } > } > output { > stdout {codec => rubydebug} > } ``` Input =\> Apr 17 09:32:01 ``` > { > "@timestamp" => 2017-07-10T15:52:13.091Z, > "@version" => "1", > "host" => "SWPAFRCT801", > "message" => "Apr 17 09:32:01\r", > "tags" => [ > [0] "_dateparsefailure" > ] > } ``` Something is really weird and not understandable... I'm new on logstash, maybe my fault. FYI, i'm using logstash 5.4.3 actually ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 10, 2017, 4:00pm UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488/3 "2017-07-10T16:00:49Z")
How are you getting the data into Logstash? Might it be that those fields are already dates, and not strings? ---
**Author:** ![FR-TheS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fr-thes/32/17396_2.png) [@FR-TheS](https://discuss.elastic.co/u/FR-TheS)\ **Post date:** [July 10, 2017, 4:05pm UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488/4 "2017-07-10T16:05:26Z")
In first post, it's a datetime field getting on an sql server, Second post, it's directly on input so I think it's a string ? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 10, 2017, 4:09pm UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488/5 "2017-07-10T16:09:36Z")
What does the event look like if you output it to a `stdout` output plugin with a `rubydebug` codec? ---
**Author:** ![FR-TheS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fr-thes/32/17396_2.png) [@FR-TheS](https://discuss.elastic.co/u/FR-TheS)\ **Post date:** [July 10, 2017, 4:16pm UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488/6 "2017-07-10T16:16:44Z")
a dateparsefailure. ``` > { > "@timestamp" => 2017-07-10T16:16:01.944Z, > "xdateinserted" => 2017-07-01T00:00:10.153Z, > "@version" => "1", > "tags" => [ > [0] "_dateparsefailure" > ] > } ``` Configuration : \> filter { \> date { \> match =\> ["xdateinserted" , "yyyy-MM-dd'T'HH:mm:ss.SSSZ"] \> } \> } \> output { \> stdout {codec =\> rubydebug} \> } ---
**Author:** ![FR-TheS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fr-thes/32/17396_2.png) [@FR-TheS](https://discuss.elastic.co/u/FR-TheS)\ **Post date:** [July 11, 2017, 10:02am UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488/7 "2017-07-11T10:02:39Z")
Any news ? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 11, 2017, 10:13am UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488/8 "2017-07-11T10:13:14Z")
As far as I can see it looks like it may already be a date field as there are no quotation marks to indicate that it is a string. ---
**Author:** ![FR-TheS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fr-thes/32/17396_2.png) [@FR-TheS](https://discuss.elastic.co/u/FR-TheS)\ **Post date:** [July 11, 2017, 11:25am UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488/9 "2017-07-11T11:25:51Z")
Thanks for the return. Yes it's already a date field from sql server but how can I replace the default timestamp by this value? And why when I tried the action of my second msg, it's again a dateparsefailure from string input? Just want to understand, sorry. ---
**Author:** ![Leandro\_Sampaio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_sampaio/32/18409_2.png) [@Leandro\_Sampaio](https://discuss.elastic.co/u/Leandro_Sampaio)\ **Post date:** [July 11, 2017, 11:40am UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488/10 "2017-07-11T11:40:14Z")
Use a function date .... It's the best solution . ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 11, 2017, 2:58pm UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488/11 "2017-07-11T14:58:48Z")
> Yes it's already a date field from sql server but how can I replace the default timestamp by this value? You can just use a mutate filter to copy the field value. > And why when I tried the action of my second msg, it's again a dateparsefailure from string input? > > > When using the jdbc input to fetch events from a database, timestamp fields end …up as timestamp fields in Logstash. One could argue that this is a feature, but it causes confusion since those fields apparently can't be processed by the date filter. Could we either call to\_s on the source string or check if the source already is a timestamp and, if so, just copy it to the destination field? > > See https://discuss.elastic.co/t/trouble-matching-timestamp/83768 for an example. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 8, 2017, 3:08pm UTC](https://discuss.elastic.co/t/replace-timestamp-by-a-other-field/92488/12 "2017-08-08T15:08:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.