# The day of date is always one in kibana and different that elastic search

**URL:** <https://discuss.elastic.co/t/the-day-of-date-is-always-one-in-kibana-and-different-that-elastic-search/300478>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [March 23, 2022, 3:21pm UTC](https://discuss.elastic.co/t/the-day-of-date-is-always-one-in-kibana-and-different-that-elastic-search/300478 "2022-03-23T15:21:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tarek0811](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@tarek0811](https://discuss.elastic.co/u/tarek0811)\
**Post date:** [March 23, 2022, 3:21pm UTC](https://discuss.elastic.co/t/the-day-of-date-is-always-one-in-kibana-and-different-that-elastic-search/300478/1 "2022-03-23T15:21:41Z")

</div>

Hi, the day of date in kibana is showing always 1 , regardless of the date in my log or in Elasticsearch.  
i am using elk docker-compose with the latest version.  
my logstash config:  
grok {  
match =\> { "message" =\>  
[  
"^%{TIMESTAMP:rtimestamp}%{SPACE}%{DIGIT:PID}%{SPACE}%{DIGIT:TID}%{SPACE}%{LETTER:log-level}%{SPACE}%{GREEDYDATA}"  
]  
} # match of msg  
} # end of grok  
pattern file:  
DIGIT \d+  
TIMESTAMP \d\d-\d\d \d\d:\d\d:\d\d.\d\d\d

in kibana discover the field rtimestamp is showing always **1** as day in the date, instead of **14**

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f61bacbf73e4ef2224baaa6797a3ce21f73bc6f2.png)  
in the dev console showing the right day of date:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/c/cca93ca8ee5a1c073db0b7b5c8a90ca8aea0a7eb.png)  
the data view in kibana showing with correct sample 03- **14**  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/0/10c723a95e6fee06be8d831148cfa5d60c1899f8.png)  
my advanced settings:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb7484ebd9d43da5a51cd778f93d0db7a437b46f.png)

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [March 24, 2022, 7:56pm UTC](https://discuss.elastic.co/t/the-day-of-date-is-always-one-in-kibana-and-different-that-elastic-search/300478/2 "2022-03-24T19:56:40Z")

</div>

Try little d for your format. `MM-dd HH:mm:ss.SSSS`. Capital `D` is Day of Year and little `d` is Day of Month. [Docs](https://docs.oracle.com/javase/8/docs/api/java/time/format/DateTimeFormatter.html).

---

<div class="post-metadata">

**Author:** ![tarek0811](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@tarek0811](https://discuss.elastic.co/u/tarek0811)\
**Post date:** [March 28, 2022, 9:02am UTC](https://discuss.elastic.co/t/the-day-of-date-is-always-one-in-kibana-and-different-that-elastic-search/300478/3 "2022-03-28T09:02:41Z")

</div>

it didnt work with dd  
it show the day name:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/8/786b1796baf6310c2473d609fee002d074064c0a.png)

with one d it showing one number...  
do you think its a bug?

---

<div class="post-metadata">

**Author:** ![tarek0811](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@tarek0811](https://discuss.elastic.co/u/tarek0811)\
**Post date:** [April 6, 2022, 9:52am UTC](https://discuss.elastic.co/t/the-day-of-date-is-always-one-in-kibana-and-different-that-elastic-search/300478/4 "2022-04-06T09:52:10Z")

</div>

i found the error, it was the mapping format in Elasticsearch , it was MM-DD but it should be MM-dd  
but in kibana settings its correct MM-DD

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 4, 2022, 9:52am UTC](https://discuss.elastic.co/t/the-day-of-date-is-always-one-in-kibana-and-different-that-elastic-search/300478/5 "2022-05-04T09:52:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.