# Replacing @timestamp with a custom field does not occur

**URL:** https://discuss.elastic.co/t/replacing-timestamp-with-a-custom-field-does-not-occur/63627
**Category:** Logstash
**Created:** [October 21, 2016, 2:48pm UTC](https://discuss.elastic.co/t/replacing-timestamp-with-a-custom-field-does-not-occur/63627 "2016-10-21T14:48:51Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![the\_iobender](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@the\_iobender](https://discuss.elastic.co/u/the_iobender)
#### Post date: [October 21, 2016, 2:48pm UTC](https://discuss.elastic.co/t/replacing-timestamp-with-a-custom-field-does-not-occur/63627/1 "2016-10-21T14:48:51Z")

</div>

Hello,

I am currently using the HTTP-IN plugin to receive HTTP PUT requests from various systems.

The systems have a field called CreationTime which I am trying to use instead of the @timestamp field.

I have read few threads and none of the fixes seemed to help and the @timestamp is not being replaced.

The CreationTime test value is:

> 21/10/2016 15:13:06

My configuration file contents:

> ```
> input {
> http{
> port => 8080
> }
> }
> filter {
> date {
> match => ["CreationTime", "dd/MM/YYYY HH:mm:ss"]
> target => "@timestamp"
> }
> }
> output {
> elasticsearch {
> hosts => "127.0.0.1"
> codec => "json"
> index => "logstash-%{+YYYY.MM.dd}"
> }
> stdout { codec => rubydebug }
> }
> 
> ```

If someone could give me some pointers then I would very much appreciate that.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 23, 2016, 5:02pm UTC](https://discuss.elastic.co/t/replacing-timestamp-with-a-custom-field-does-not-occur/63627/2 "2016-10-23T17:02:33Z")

</div>

Your date filter looks correct if your events indeed have a `CreationTime` field containing a date in that format. Please give an example of an event, e.g. one captured by your `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

### Author: ![the\_iobender](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@the\_iobender](https://discuss.elastic.co/u/the_iobender)
#### Post date: [October 27, 2016, 8:35am UTC](https://discuss.elastic.co/t/replacing-timestamp-with-a-custom-field-does-not-occur/63627/3 "2016-10-27T08:35:13Z")

</div>

@magnusbaeck thanks for your reply, the below is the output I am getting in logstash, as you can see the @timestamp is not replaced by CreationTime but you may be able to point out if something is incorrect:

```
> JobId:752fc480
> StartedBy:live.com#user@outlook.com
> Exception: - 
> StatusDetails:None  
> Errors: - 
> Output: - 
> Status:Completed 
> Warnings: - 
> EndTime:21/10/2016-15:16:36 
> CreationTime:21/10/2016 15:13:06  
> runOn: - 
> Verbose: - 
> @version:1 
> @timestamp:October 21st 2016, 15:23:30.275 
> host:<IP>
> headers.request_method:PUT 
> headers.request_path:/azure/jobs/ 
> headers.request_uri:/azure/jobs/ 
> headers.http_version:HTTP/1.1 
> headers.http_user_agent:Mozilla/5.0 (Windows NT; Windows NT 6.1; en-GB) WindowsPowerShell/5.0.10586.117 
> headers.content_type:application/json 
> headers.http_host:<somehost>.cloudapp.net:8080` 
> headers.content_length:673 
> _id:AVfnoBak2aiUzdk-hbNJ 
> _type:logs 
> _index:logstash-2016.10.21
```

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 27, 2016, 8:44am UTC](https://discuss.elastic.co/t/replacing-timestamp-with-a-custom-field-does-not-occur/63627/4 "2016-10-27T08:44:47Z")

</div>

Is that the payload you are receiving? What is the output from the Logstash stdout output using the ruby debug codec?

---

<div class="post-metadata">

### Author: ![the\_iobender](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@the\_iobender](https://discuss.elastic.co/u/the_iobender)
#### Post date: [October 27, 2016, 2:59pm UTC](https://discuss.elastic.co/t/replacing-timestamp-with-a-custom-field-does-not-occur/63627/5 "2016-10-27T14:59:08Z")

</div>

This is exactly what I get in Kibana, which I am assuming is stored in Elastic search via logstash,

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 27, 2016, 3:07pm UTC](https://discuss.elastic.co/t/replacing-timestamp-with-a-custom-field-does-not-occur/63627/6 "2016-10-27T15:07:49Z")

</div>

If that is the raw message, you have not parsed out any fields, especially not the `CreationTime` that the date filter expects. You probably need to apply a grok filter or possible a kv filter to parse out the fields in Logstash before you try to use the date filter.

---

<div class="post-metadata">

### Author: ![the\_iobender](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@the\_iobender](https://discuss.elastic.co/u/the_iobender)
#### Post date: [October 27, 2016, 3:20pm UTC](https://discuss.elastic.co/t/replacing-timestamp-with-a-custom-field-does-not-occur/63627/7 "2016-10-27T15:20:59Z")

</div>

Thank you for your help. I am quite a novice in all honesty. I am not sure on what the grok filter is and what is its function and how to implement it.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:32am UTC](https://discuss.elastic.co/t/replacing-timestamp-with-a-custom-field-does-not-occur/63627/8 "2017-07-06T04:32:18Z")

</div>