# Replacing @timestamp

**URL:** <https://discuss.elastic.co/t/replacing-timestamp/40993>\
**Category:** Logstash\
**Created:** [February 4, 2016, 6:01pm UTC](https://discuss.elastic.co/t/replacing-timestamp/40993 "2016-02-04T18:01:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tikejhya](https://avatars.discourse-cdn.com/v4/letter/t/77aa72/32.png) [@tikejhya](https://discuss.elastic.co/u/tikejhya)\
**Post date:** [February 4, 2016, 6:01pm UTC](https://discuss.elastic.co/t/replacing-timestamp/40993/1 "2016-02-04T18:01:18Z")

</div>

I am trying to replace @timestamp with actual logfile timestamp

i find it not working with change in pattern:

for instance: this works for 01/01/2016:  
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss]

But not with 2016/01/01 format

date {  
match =\> ["timestamp", "YYYY/MM/dd HH:mm:ss"]  
target =\> "@timestamp"  
add\_field =\> { "debug" =\> "timestampMatched"}

test1 with: YYYY/MM/dd HH:mm:ss  
:response=\>{"create"=\>{"\_index"=\>"logstash-2016.01.04", "\_type"=\>"Nginx-Error-Log", "_id"=\>"AVKta1qSTV0U2R_-BZO-", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [timestamp]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "2016/02/04 17:53:48" is malformed at "/02/04 17:53:48""}}}}, :level=\>:warn}

test2 with: YYYY/MMM/dd HH:mm:ss  
{:timestamp=\>"2016-02-04T17:45:51.774000+0000", :message=\>"Failed parsing date from field", :field=\>"timestamp", :value=\>"2016/02/04 17:45:44", :exception=\>"Invalid format: "2016/02/04 17:45:44" is malformed at "02/04 17:45:44"", :config\_parsers=\>"YYYY/MMM/dd HH:mm:ss", :config\_locale=\>"en", :level=\>:warn}

can anyone suggest how this should be matched?

---

<div class="post-metadata">

**Author:** ![tikejhya](https://avatars.discourse-cdn.com/v4/letter/t/77aa72/32.png) [@tikejhya](https://discuss.elastic.co/u/tikejhya)\
**Post date:** [February 4, 2016, 6:05pm UTC](https://discuss.elastic.co/t/replacing-timestamp/40993/2 "2016-02-04T18:05:22Z")

</div>

match =\> ["timestamp", "YY/MM/dd HH:mm:ss"]

This seem to match, 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:13am UTC](https://discuss.elastic.co/t/replacing-timestamp/40993/3 "2017-07-06T05:13:02Z")

</div>