# Replace @timestamp or add new field with time from log file

**URL:** https://discuss.elastic.co/t/replace-timestamp-or-add-new-field-with-time-from-log-file/211007
**Category:** Logstash
**Created:** [December 8, 2019, 12:47pm UTC](https://discuss.elastic.co/t/replace-timestamp-or-add-new-field-with-time-from-log-file/211007 "2019-12-08T12:47:29Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![pashang](https://avatars.discourse-cdn.com/v4/letter/p/f19dbf/32.png) [@pashang](https://discuss.elastic.co/u/pashang)
#### Post date: [December 8, 2019, 12:47pm UTC](https://discuss.elastic.co/t/replace-timestamp-or-add-new-field-with-time-from-log-file/211007/1 "2019-12-08T12:47:29Z")

</div>

I have below sample log and I need to replace @timestamp or add new field from 15:38:43.335 segment.

> -15:38:43.335 U888 ExecuteThread: '3' for queue ...

I used below filter but not worked.

> ```
> filter {
> date {
> match => ["message" , "'-'HH:mm:ss.SSS"]
> target => "@timestamp"
> }
> 
> ```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 8, 2019, 2:35pm UTC](https://discuss.elastic.co/t/replace-timestamp-or-add-new-field-with-time-from-log-file/211007/2 "2019-12-08T14:35:34Z")

</div>

A date filter has to match the entire field, not just a prefix. You could use dissect (or grok) to parse out the timestamp from the message and then match against just that.

---

<div class="post-metadata">

### Author: ![pashang](https://avatars.discourse-cdn.com/v4/letter/p/f19dbf/32.png) [@pashang](https://discuss.elastic.co/u/pashang)
#### Post date: [December 9, 2019, 3:51am UTC](https://discuss.elastic.co/t/replace-timestamp-or-add-new-field-with-time-from-log-file/211007/3 "2019-12-09T03:51:15Z")

</div>

Thanks for reply.

I used below filter:

> dissect {  
> mapping =\> { 'message' =\> '%{@timestamp} %{message}' }  
> }

but logstash failed because there is an exception in piplenworker for '-' character in front of time. how can remove '-' character and change that format to yyyy-MM-dd HH:mm:ss.SSS in same time?

also I need put that to @timestamp for sorting in kibana dashboard.

---

<div class="post-metadata">

### Author: ![pashang](https://avatars.discourse-cdn.com/v4/letter/p/f19dbf/32.png) [@pashang](https://discuss.elastic.co/u/pashang)
#### Post date: [December 9, 2019, 6:27am UTC](https://discuss.elastic.co/t/replace-timestamp-or-add-new-field-with-time-from-log-file/211007/4 "2019-12-09T06:27:33Z")

</div>

I found solution from below link:

[https://discuss.elastic.co/t/logstash-cannot-assign-correct-date-to-log-timestamp/89249/7?u=pashang](https://discuss.elastic.co/t/logstash-cannot-assign-correct-date-to-log-timestamp/89249/7)

and I used below filter:

> filter {  
> grok { match =\> {"message" =\> "(?[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3})"} }  
> ruby { code =\> 'event.set("currentDate", Time.now.strftime("%Y.%m.%d"))' }  
> ruby { code =\> 'event.set("logTimestamp", event.get("currentDate") + " " + event.get("logTime"))' }  
> date { match =\> ["logTimestamp", "YYYY.MM.dd HH:mm:ss.SSS"] }  
> }

thanks every one 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 6, 2020, 6:27am UTC](https://discuss.elastic.co/t/replace-timestamp-or-add-new-field-with-time-from-log-file/211007/5 "2020-01-06T06:27:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.