# Replace @timestamp with some other field **URL:** \ **Category:** Logstash\ **Created:** [August 29, 2015, 2:41pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284 "2015-08-29T14:41:45Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![ajays](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@ajays](https://discuss.elastic.co/u/ajays)\ **Post date:** [August 29, 2015, 2:41pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284/1 "2015-08-29T14:41:45Z")
Hi, I want to replace @timestamp with some other timestamp field having format like this 11/Jan/2014:05:06:24 +05:30. Can anybody please help? Regards, AjayS ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 29, 2015, 3:20pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284/2 "2015-08-29T15:20:29Z")
Could you elaborate on what underlying problem you're trying to solve? Normally, reformatting and making timezone adjustments is something that the presentation layer should do, not Logstash. ---
**Author:** ![ajays](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@ajays](https://discuss.elastic.co/u/ajays)\ **Post date:** [August 29, 2015, 4:09pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284/3 "2015-08-29T16:09:49Z")
@magnusbaeck, Thanks for your reply and yes you are correct presentation layer should do this type of adjustment. But out of interest I want to know how to replace and match this type of timestamp. I am having this type of timestamp entry in my log files 11/Jan/2014:05:06:24 +05:30 and I am not able to match it in filter plugin. I used "dd/mm/yy HH:mm:ss +5:30" but it is saying "\_dateparsefailure" error. I tried this but the same error ``` date { match => { "event_time" => ["dd/mm/yy HH:mm:ss +5:30"] } target => "@timestamp" } ``` Regards, AjayS ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 29, 2015, 4:18pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284/4 "2015-08-29T16:18:30Z")
Why not use the `Z` token to have it parse "+5:30" as a timezone offset? Anyway, your pattern has a couple of issues: - There's a colon between the year and the hour, not a space. - 'm' means minute. Use 'M' for months. - Since it's the name of a month you want to match and not its number, use 'MMM'. The following configuration example should be applicable in your case: [https://www.elastic.co/guide/en/logstash/current/config-examples.html#\_processing\_apache\_logs](https://www.elastic.co/guide/en/logstash/current/config-examples.html#_processing_apache_logs) ---
**Author:** ![ajays](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@ajays](https://discuss.elastic.co/u/ajays)\ **Post date:** [August 29, 2015, 4:28pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284/5 "2015-08-29T16:28:38Z")
@magnusbaeck, Thanks. It is working now after following your suggestions. I should have checked properly. Regards, AjayS ---
**Author:** ![nishant\_goel](https://avatars.discourse-cdn.com/v4/letter/n/e47774/32.png) [@nishant\_goel](https://discuss.elastic.co/u/nishant_goel)\ **Post date:** [June 17, 2016, 10:11pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284/6 "2016-06-17T22:11:07Z")
@magnusbaeck Hi Magnus, I have a timestamp in the format "YYYY-MM-DD HH:mm:ss" in my logs and I want to assign this to @timestamp of logstash. I have tried using a date filter like below: date{ ``` match => ["timestamp", "YYYY-MM-DD HH:mm:ss"] } ``` However, the value is not being assigned correctly. Could you please help me in this. mytimestamp: 2016-06-13 10:00:34 assigned value to @timestamp: "2016-01-13T18:00:34.000Z" ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 20, 2016, 5:36am UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284/7 "2016-06-20T05:36:53Z")
[As documented](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/DateTimeFormat.html), the day of month is "dd" and not "DD". ---
**Author:** ![nishant\_goel](https://avatars.discourse-cdn.com/v4/letter/n/e47774/32.png) [@nishant\_goel](https://discuss.elastic.co/u/nishant_goel)\ **Post date:** [June 21, 2016, 5:17pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284/8 "2016-06-21T17:17:33Z")
Thanks @magnusbaeck. Really appreciate the help. ---
**Author:** ![hearvishwas](https://avatars.discourse-cdn.com/v4/letter/h/cc9497/32.png) [@hearvishwas](https://discuss.elastic.co/u/hearvishwas)\ **Post date:** [June 28, 2016, 6:47am UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284/9 "2016-06-28T06:47:00Z")
Hi, I have log file of my java application and this file contains xml. Sample xml:- \ \1222.32 \ \2016-04-25 \ \ \ My log file has many such xmls. I want to use DATE and TIME field value of this xml as value of @timestamp in logstash. By default @timestamp of logstash stores current date and time. I used the help provided above but logstash is throwing warning saying: **Failed parsing date from field {:field=\>"nginx\_timestamp", :value=\>"[EMLC\_DATE] [EMLC\_TIME]", :exception=\>"Invalid format: "[EMLC\_DATE] [EMLC\_TIME]"", :config\_parsers=\>"yyyy-MM-dd HH:mm:ss.SSS", :config\_locale=\>"default=en\_IN", :level=\>:warn}** When I check the same in kibana than @timestamp have current date and time. Here is my filter filter { ``` xml { store_xml => "false" source => "message" xpath => [ "/RECORD/EPOCH/text()", "EMLC_EPOCH", "/RECORD/DATE/text()", "EMLC_DATE", "/RECORD/TIME/text()", "EMLC_TIME", ] } mutate { strip => "%{EMLC_DATE}" strip => "%{EMLC_TIME}" add_field => ["nginx_timestamp", "%{EMLC_DATE} %{EMLC_TIME}"] } date { match => ["nginx_timestamp", "yyyy-MM-dd HH:mm:ss.SSS"] } mutate { remove_field => ["nginx_timestamp"] } } ``` I am using logstash 2.3 Can anyone help me? ---
**Author:** ![hearvishwas](https://avatars.discourse-cdn.com/v4/letter/h/cc9497/32.png) [@hearvishwas](https://discuss.elastic.co/u/hearvishwas)\ **Post date:** [June 28, 2016, 6:50am UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284/10 "2016-06-28T06:50:58Z")
Hi, I have log file of my java application and this file contains xml. Sample xml: \ \1222.32 \ \2016-04-25 \ \ \ My log file has many such xmls. I want to use DATE and TIME field value of this xml as value of @timestamp in logstash. By default @timestamp of logstash stores current date and time. I used the help provided above but logstash is throwing warning saying: **Failed parsing date from field {:field=\>"nginx\_timestamp", :value=\>"[EMLC\_DATE] [EMLC\_TIME]", :exception=\>"Invalid format: "[EMLC\_DATE] [EMLC\_TIME]"", :config\_parsers=\>"yyyy-MM-dd HH:mm:ss.SSS", :config\_locale=\>"default=en\_IN", :level=\>:warn}** When I check the same in kibana than @timestamp have current date and time. Here is my filter filter { ``` xml { store_xml => "false" source => "message" xpath => [ "/RECORD/EPOCH/text()", "EMLC_EPOCH", "/RECORD/DATE/text()", "EMLC_DATE", "/RECORD/TIME/text()", "EMLC_TIME", ] } mutate { strip => "%{EMLC_DATE}" strip => "%{EMLC_TIME}" add_field => ["nginx_timestamp", "%{EMLC_DATE} %{EMLC_TIME}"] } date { match => ["nginx_timestamp", "yyyy-MM-dd HH:mm:ss.SSS"] } mutate { remove_field => ["nginx_timestamp"] } } ``` I am using logstash 2.3 Can you please help me? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 30, 2016, 7:18am UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284/11 "2016-06-30T07:18:41Z")
@hearvishwas, please start a new thread for your unrelated problem. Let's not make this thread a catch-all for each and every date filter related problem. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/replace-timestamp-with-some-other-field/28284/12 "2017-07-06T04:50:14Z")