# Replace @timestamp with actual timestamp from log file

**URL:** <https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file/271022>\
**Category:** Logstash\
**Created:** [April 22, 2021, 9:39pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file/271022 "2021-04-22T21:39:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kommineni24](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kommineni24/32/117038_2.png) [@kommineni24](https://discuss.elastic.co/u/kommineni24)\
**Post date:** [April 22, 2021, 9:39pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file/271022/1 "2021-04-22T21:39:27Z")

</div>

Hi,  
I am trying to index my mail-relay log files to Elastic search. All the log entries are being indexed into a field named _message_ . @timestamp field shows the time the entry was indexed and not the timestamp from the log entry.

**Below are the source log file lines sample:**

```
2021-04-21 15:00:03 104.47.58.138 OutboundConnectionCommand SMTPSVC1 LWMAILVU1 - 25 BDAT - 10695+LAST 0 0 4 0 1969 SMTP - - - -
2021-04-21 15:00:03 104.47.58.138 OutboundConnectionResponse SMTPSVC1 LWMAILVU1 - 25 - - 250+2.1.5+Recipient+OK 0 0 22 0 1969 SMTP - - - -

```

I have tried a couple of ways like by using dissect and grok filter but no luck.

**Dissect Filter:**

```
 input {
      beats {
        port => 5044
      }
    }

    filter {
    dissect { mapping => { "message" => "%{[@metadata][timestamp]} %{+[@metadata][timestamp]} %{+[@metadata][timestamp]}" } }
        date { match => ["[@metadata][timestamp]", "MMM dd HH:mm:ss" ] }
     }

```

**Grok filter:**

```
input {
  beats {
    port => 5044
  }
}

filter {
grok {
      match => ["message", "(?<sourcestamp>(\d){4}-(\d){2}-(\d){2} (\d){2}:(\d){2}:(\d){2},(\d){3})"]
    }
    date {
      match => ["sourcestamp" , "yyyy-MM-dd HH:mm:ss,SSS"]
      target => "@timestamp"
      timezone => "America/Chicago"
}
}

```

Any help would be appreciated. Thank you!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 22, 2021, 10:12pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file/271022/2 "2021-04-22T22:12:08Z")

</div>

The timestamp is the first two words of the message, not three. Try

```
dissect { mapping => { "message" => "%{[@metadata][timestamp]} %{+[@metadata][timestamp]} %{}" } }

```

You need the trailing %{} to match the rest of the message. And your timestamp format is not "MMM dd HH:mm:ss". Try

```
    date { match => ["[@metadata][timestamp]", "yyyy-MM-dd HH:mm:ss" ] }
```

---

<div class="post-metadata">

**Author:** ![kommineni24](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kommineni24/32/117038_2.png) [@kommineni24](https://discuss.elastic.co/u/kommineni24)\
**Post date:** [April 22, 2021, 11:04pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file/271022/3 "2021-04-22T23:04:46Z")

</div>

> [@Badger](#):
>

Thank you very much! It's working now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 20, 2021, 11:05pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file/271022/4 "2021-05-20T23:05:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.