# Replace @timestamp in kibana / logstash with time attribute of my log **URL:** \ **Category:** Logstash\ **Created:** [July 21, 2017, 7:03am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064 "2017-07-21T07:03:21Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![diooda](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diooda](https://discuss.elastic.co/u/diooda)\ **Post date:** [July 21, 2017, 7:03am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/1 "2017-07-21T07:03:21Z")
I want to do replace @timestamp in kibana / logstash, want to change to the time attribute in my logfile ,, what should i do? thank you 🙂 ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 21, 2017, 7:22am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/2 "2017-07-21T07:22:32Z")
Use the [Logstash date filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html). If you search this forum you should be able to find lots of examples as this its a very common question. ---
**Author:** ![diooda](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diooda](https://discuss.elastic.co/u/diooda)\ **Post date:** [July 21, 2017, 7:46am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/3 "2017-07-21T07:46:55Z")
Where do I put the codes? sorry, Because I just got to know the elk stack .. 🙂 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 25, 2017, 8:50pm UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/4 "2017-07-25T20:50:03Z")
See the Logstash configuration examples for inspiration and try to ask a more specific question (for example, we can't give you specific help without knowing what your log looks like). [https://www.elastic.co/guide/en/logstash/current/config-examples.html](https://www.elastic.co/guide/en/logstash/current/config-examples.html) ---
**Author:** ![diooda](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diooda](https://discuss.elastic.co/u/diooda)\ **Post date:** [August 10, 2017, 9:42am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/5 "2017-08-10T09:42:07Z")
code in logstash.conf ![1](https://us1.discourse-cdn.com/elastic/original/3X/5/c/5c044c671b1fb29690883abf34e9c1bcc96f610b.jpg) Display in Discover kibana menu ![2](https://us1.discourse-cdn.com/elastic/original/3X/0/7/07fb88391d4b0442a1f5a26923ae8b0e175cb01d.jpg) Attribute "AssociationTime" to be replaced to timestamp ![3](https://us1.discourse-cdn.com/elastic/original/3X/1/7/1730f4eadcfc8f07afc1b217077ac2f4d66f1f12.PNG) i try, but can not Replace @timestamp in kibana / logstash with time attribute of my log Please help and guidance 🙂 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 10, 2017, 10:57am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/6 "2017-08-10T10:57:14Z")
Filters are evaluated in the order listed in the configuration file so the date filter must follow the csv filter. ---
**Author:** ![diooda](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diooda](https://discuss.elastic.co/u/diooda)\ **Post date:** [August 10, 2017, 2:43pm UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/7 "2017-08-10T14:43:47Z")
Is this Code correct? date { match ==\> ["AssociationTime", "dd/mm/yyyy hh:mm"] } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 10, 2017, 2:55pm UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/8 "2017-08-10T14:55:03Z")
No, use `dd/MM/yyyy HH:mm`. See the docs. ---
**Author:** ![diooda](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diooda](https://discuss.elastic.co/u/diooda)\ **Post date:** [August 11, 2017, 7:39am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/9 "2017-08-11T07:39:59Z")
> [@magnusbaeck](#): > > dd/MM/yyyy HH:mm I use this code in logstash.conf, but still timestamp is time to import csv file ,, so not from time attribute "AssociationTime" date { match ==\> [“AssociationTime”, “dd/MM/yyyy HH:mm”] } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 11, 2017, 7:53am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/10 "2017-08-11T07:53:03Z")
Show us an example event. Use a `stdout { codec => rubydebug }` output or copy/paste from Kibana's JSON tab. ---
**Author:** ![diooda](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diooda](https://discuss.elastic.co/u/diooda)\ **Post date:** [August 11, 2017, 8:08am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/11 "2017-08-11T08:08:10Z")
> [@magnusbaeck](#): > > Kibana’s JSON tab i dont know location kibana json tab ![4](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8c7e178123912afa80ebbcac8cdf59800605dc14.jpg) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 11, 2017, 8:51am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/12 "2017-08-11T08:51:46Z")
Expand an example event using the little triangle to the left of the timestamp and you'll find a JSON tab. ---
**Author:** ![diooda](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diooda](https://discuss.elastic.co/u/diooda)\ **Post date:** [August 11, 2017, 10:18am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/13 "2017-08-11T10:18:02Z")
> [@magnusbaeck](#): > > Expand an example event using the little triangle to the left of the timestamp and you’ll find a JSON tab This is my Kibana’s JSON tab ![5](https://us1.discourse-cdn.com/elastic/original/3X/b/d/bda84235ba7bcdb006c573f130d24b3322653a40.jpg) What do I need to fix? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 11, 2017, 11:10am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/14 "2017-08-11T11:10:39Z")
Does your filter really look like this? > date { > match ==\> [“AssociationTime”, “dd/MM/yyyy HH:mm”] > } `==>` should be `=>`. ---
**Author:** ![diooda](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diooda](https://discuss.elastic.co/u/diooda)\ **Post date:** [August 11, 2017, 5:21pm UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/15 "2017-08-11T17:21:06Z")
Yes, I have tried, but still not succeed ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 11, 2017, 6:08pm UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/16 "2017-08-11T18:08:35Z")
Post your configuration so we can try it out. Use copy/paste. **Do not post a screenshot.** ---
**Author:** ![diooda](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diooda](https://discuss.elastic.co/u/diooda)\ **Post date:** [August 14, 2017, 6:38am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/17 "2017-08-14T06:38:06Z")
my configuration input { file { path =\> "/home/angga/Documents/allfixv12.csv" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { date { match =\> ["AssociationTime", "dd/MM/yyyy HH:mm"] target =\> "@timestamp" timezone =\> "Asia/Jakarta" } csv { separator =\> "," columns =\> ["Username","DeviceType","Role","AP/Device","SSID","Interface","ConnectionMode","SNMPSource","AssociationTime","Date","Time","DurationMenit","Auth.Type","TotalDataMB"] } mutate {convert =\> ["Username", "string"]} mutate {convert =\> ["DeviceType", "string"]} mutate {convert =\> ["Role", "string"]} mutate {convert =\> ["AP/Device", "string"]} mutate {convert =\> ["SSID", "string"]} mutate {convert =\> ["Interface", "string"]} mutate {convert =\> ["ConnectionMode", "string"]} mutate {convert =\> ["SNMPSource", "string"]} mutate {convert =\> ["Date", "string"]} mutate {convert =\> ["Time", "string"]} mutate {convert =\> ["DurationMenit", "integer"]} mutate {convert =\> ["Auth.Type", "string"]} mutate {convert =\> ["TotalDataMB", "float"]} } output { elasticsearch { hosts =\> "localhost" index =\> "testajaah" } stdout { codec =\> rubydebug } } ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 14, 2017, 6:41am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/18 "2017-08-14T06:41:50Z")
Filters are applied in order, so you must place the `date` filter after the `csv` filter as the field otherwise is not available. ---
**Author:** ![diooda](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diooda](https://discuss.elastic.co/u/diooda)\ **Post date:** [August 14, 2017, 6:59am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/19 "2017-08-14T06:59:40Z")
This is it? input { file { path =\> "/home/angga/Documents/allfixv12.csv" start\_position =\> "beginning" sincedb\_path =\> “/dev/null” } } filter { csv { separator =\> "," columns =\> [“Username”,“DeviceType”,“Role”,“AP/Device”,“SSID”,“Interface”,“ConnectionMode”,“SNMPSource”,“AssociationTime”,“Date”,“Time”,“DurationMenit”,“Auth.Type”,“TotalDataMB”] } date { match =\> [“AssociationTime”, “dd/MM/yyyy HH:mm”] target =\> "@timestamp" timezone =\> “Asia/Jakarta” } mutate {convert =\> [“Username”, “string”]} mutate {convert =\> [“DeviceType”, “string”]} mutate {convert =\> [“Role”, “string”]} mutate {convert =\> [“AP/Device”, “string”]} mutate {convert =\> [“SSID”, “string”]} mutate {convert =\> [“Interface”, “string”]} mutate {convert =\> [“ConnectionMode”, “string”]} mutate {convert =\> [“SNMPSource”, “string”]} mutate {convert =\> [“Date”, “string”]} mutate {convert =\> [“Time”, “string”]} mutate {convert =\> [“DurationMenit”, “integer”]} mutate {convert =\> [“Auth.Type”, “string”]} mutate {convert =\> [“TotalDataMB”, “float”]} } output { elasticsearch { hosts =\> "localhost" index =\> “testajaah” } stdout { codec =\> rubydebug } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 14, 2017, 7:21am UTC](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064/20 "2017-08-14T07:21:05Z")
Why don't you try it? But yes, this looks better. [Next page](https://discuss.elastic.co/t/replace-timestamp-in-kibana-logstash-with-time-attribute-of-my-log/94064.md?page=2)