# Starting new filebeat agent and the time is incorrect on the UI

**URL:** <https://discuss.elastic.co/t/starting-new-filebeat-agent-and-the-time-is-incorrect-on-the-ui/218015>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 5, 2020, 3:23pm UTC](https://discuss.elastic.co/t/starting-new-filebeat-agent-and-the-time-is-incorrect-on-the-ui/218015 "2020-02-05T15:23:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![andras.vecsi](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@andras.vecsi](https://discuss.elastic.co/u/andras.vecsi)\
**Post date:** [February 5, 2020, 3:23pm UTC](https://discuss.elastic.co/t/starting-new-filebeat-agent-and-the-time-is-incorrect-on-the-ui/218015/1 "2020-02-05T15:23:30Z")

</div>

Hello,

What I see on the kibana UI

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/2/22445f98cb0d60a795ccefedca22cd51bf998e13.png)

The message in my logs are generated like this  
2020-02-05 14:55:46.428 | DEBUG | http-nio-8089-exec-2 | CommonsRequestLoggingFilter:47 | Before request [XXX]

The log was generated at 2020-02-05 14:55:46.428 but on the UI I can see the @time is set to when I started the agent:Feb 5, 2020 @ 16:07:01.286

This is an agent which is installed with version 7.5.0-1 but there was already an agent on the host with version 6.3

The output from yum:  
Running transaction  
Updating : filebeat-7.5.0-1.x86\_64  
warning: /etc/filebeat/filebeat.yml created as /etc/filebeat/filebeat.yml.rpmnew  
Cleanup : filebeat-6.3.2-1.x86\_64  
Verifying : filebeat-7.5.0-1.x86\_64  
Verifying : filebeat-6.3.2-1.x86\_64

How can I store old log files with the right timestamp and showing it on the kibana UI?  
Would it be better to cleanup old filebeat logs/configs/files before installing 7.5 ?

my grok on the logstash server:  
grok {  
match =\> [  
"message" , "%{TIMESTAMP\_ISO8601:logDate}%{SPACE}|%{SPACE}%{LOGLEVEL:logLevel}%{SPACE}|%{SPACE}(?[^|]+)%{SPACE}|%{SPACE}(?[^|]+)%{SPACE}|%{SPACE}%{GREEDYDATA:logMessage}"  
]  
}  
date {  
match =\> ["logDate", "YYYY-MM-dd HH:mm:ss.SSS"]  
}  
}

Thanks  
Andras

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 4, 2020, 3:23pm UTC](https://discuss.elastic.co/t/starting-new-filebeat-agent-and-the-time-is-incorrect-on-the-ui/218015/2 "2020-03-04T15:23:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.