# Time column it's different than @timestamp field in kibana

**URL:** https://discuss.elastic.co/t/time-column-its-different-than-timestamp-field-in-kibana/356954
**Category:** Kibana
**Tags:** elastic-stack-monitoring
**Created:** [April 8, 2024, 9:37am UTC](https://discuss.elastic.co/t/time-column-its-different-than-timestamp-field-in-kibana/356954 "2024-04-08T09:37:13Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Fateme\_Alizade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fateme_alizade/32/114465_2.png) [@Fateme\_Alizade](https://discuss.elastic.co/u/Fateme_Alizade)
#### Post date: [April 8, 2024, 9:37am UTC](https://discuss.elastic.co/t/time-column-its-different-than-timestamp-field-in-kibana/356954/1 "2024-04-08T09:37:13Z")

</div>

Hey guys!  
I have troubling with time stuff in kibana and logstash  
I have a filter pattern for my syslogs which its timestamp it's different than time column in kibana( My logs are shown in kibana 3 hours later )

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/8/184cda98ab04737207dc57c91a798a78044f1471.png)

here is my filter code for my sysligs which I'm collecting them from kubernetes pods

> ```
> date {
> match => ["timestamp", "MMM dd HH:mm:ss"]
> timezone => "Asia/Tehran"
> }
> 
> ```

also I have a grok pattern like this:

> syslog {  
> port =\> 6570  
> grok\_pattern =\> "\<%{POSINT:priority}\>%{SYSLOGTIMESTAMP:timestamp} %{DATA:program}: %{GREEDYDATA:message}"

I have googled a hundred of pages but I couldn't find anything that matches my issue or maybe I missed it  
Can anyone help me with this issue?

---

<div class="post-metadata">

### Author: ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)
#### Post date: [April 8, 2024, 3:33pm UTC](https://discuss.elastic.co/t/time-column-its-different-than-timestamp-field-in-kibana/356954/2 "2024-04-08T15:33:25Z")

</div>

Hi Raha. I think you might need to change the default timestamp field in your [Data View](https://www.elastic.co/guide/en/kibana/current/managing-data-views.html).

 ![Screenshot 2024-04-08 at 11.32.42 AM](https://us1.discourse-cdn.com/elastic/original/3X/9/6/9676b9d49e7b6094257df8bc55dd3f8f9c8dab29.png)

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 8, 2024, 3:43pm UTC](https://discuss.elastic.co/t/time-column-its-different-than-timestamp-field-in-kibana/356954/3 "2024-04-08T15:43:23Z")

</div>

> [@Fateme\_Alizade](#):
>
> \<%{POSINT:priority}\>%{SYSLOGTIMESTAMP:timestamp} %{DATA:program}: %{GREEDYDATA:message}

Please share the original message so it is possible to see how the timestamp field is being parsed.

The event you shared does not show how the `timestamp` field looks like.

---

<div class="post-metadata">

### Author: ![Fateme\_Alizade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fateme_alizade/32/114465_2.png) [@Fateme\_Alizade](https://discuss.elastic.co/u/Fateme_Alizade)
#### Post date: [April 8, 2024, 4:54pm UTC](https://discuss.elastic.co/t/time-column-its-different-than-timestamp-field-in-kibana/356954/4 "2024-04-08T16:54:51Z")

</div>

Issue was about this line

> ```
> date {
> **match => ["timestamp", "MMM dd HH:mm:ss"]**
> timezone => "Asia/Tehran"
> }
> 
> ```

It couldn't match my timestamp with this format  
I changed it to:

> match =\> ["timestamp", "MMM d HH:mm:ss"]

and it resolved my issue