# Time mismatch @timestamp and message **URL:** \ **Category:** Logstash\ **Created:** [January 29, 2020, 12:34pm UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999 "2020-01-29T12:34:10Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![faridmmv](https://avatars.discourse-cdn.com/v4/letter/f/0ea827/32.png) [@faridmmv](https://discuss.elastic.co/u/faridmmv)\ **Post date:** [January 29, 2020, 12:34pm UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/1 "2020-01-29T12:34:10Z")
Hi. How can i configure logstash to have @timestamp and message time equal. ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/4/241bb8597eccc71046c52805fc64657be64c041f.png) My Config is: ``` input { beats { port => 5044 } } filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } syslog_pri { } date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } output { elasticsearch { hosts => "localhost:9200" index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" } } ``` ---
**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\ **Post date:** [January 29, 2020, 2:07pm UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/2 "2020-01-29T14:07:04Z")
Hi @faridmmv, I'm pretty sure your logs show `_dateparsefailure` tags. The date format of `syslog_timestamp` doesn't match the date formats you list. Try something like this for the date format ```auto date { match => ["syslog_timestamp", "dd-MM-yyyy HH:mm:ss.SSS"] } ``` If I got the time format wrong, check the documentation [here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html). ---
**Author:** ![faridmmv](https://avatars.discourse-cdn.com/v4/letter/f/0ea827/32.png) [@faridmmv](https://discuss.elastic.co/u/faridmmv)\ **Post date:** [January 29, 2020, 5:40pm UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/3 "2020-01-29T17:40:01Z")
> [@A\_B](#): > > match =\> ["syslog\_timestamp", "dd-MM-yyyy HH:mm:ss.SSS"] Hi, Thanks for the reply. Actually there was no error, anyway I`ve changed the line to `match =\> ["syslog\_timestamp", "dd-MM-yyyy HH:mm:ss.SSS"]` But this did not solve timestamp and message time mismatch. Any idea how I can fix this? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 29, 2020, 5:50pm UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/4 "2020-01-29T17:50:53Z")
Can you show us a complete event copy and pasted from the JSON tab in kibana / Discover? ---
**Author:** ![faridmmv](https://avatars.discourse-cdn.com/v4/letter/f/0ea827/32.png) [@faridmmv](https://discuss.elastic.co/u/faridmmv)\ **Post date:** [January 29, 2020, 8:23pm UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/5 "2020-01-29T20:23:38Z")
``` { "_index": "filebeat-2020.01.29", "_type": "_doc", "_id": "YcJi7b7BHduoqUKWDS2v", "_version": 1, "_score": null, "_source": { "@timestamp": "2020-01-29T17:38:16.968Z", "message": "29-01-2020 21:38:12.170 [http-nio-8000-exec-499] DEBUG a.e.k.p.aop.logging.LoggingAspect.logAround -> Exit: privatedata.service.person.FinService.getPersonByIdentity() with result = ***SOME REMOVED DATA*** , "@version": "1", "host": { "containerized": false, "os": { "family": "redhat", "version": "7 (Core)", "kernel": "3.10.0-957.27.2.el7.x86_64", "platform": "centos", "codename": "Core", "name": "CentOS Linux" }, "id": "3c0265f0dd654cc5hgfdd8757f3b8a", "hostname": "server-3", "architecture": "x86_64", "name": "server-3" }, "tags": [ "beats_input_codec_plain_applied" ], "log": { "file": { "path": "/var/log/java/customService.log" }, "offset": 9588320 }, "agent": { "hostname": "server-3", "id": "4a79fbc7-968b-4cd3-a2a8-7525679fgdfk09", "version": "7.5.1", "ephemeral_id": "056f95ede-ae45-40a9-beab-a795638bc084", "type": "filebeat" }, "ecs": { "version": "1.1.0" }, "input": { "type": "log" } }, "fields": { "@timestamp": [ "2020-01-29T17:38:16.968Z" ] }, "sort": [ 15803194047695 ] } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 29, 2020, 8:45pm UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/6 "2020-01-29T20:45:57Z")
That does not contain a syslog\_timestamp field. The date filter is a no-op if the source field does not exist. ---
**Author:** ![faridmmv](https://avatars.discourse-cdn.com/v4/letter/f/0ea827/32.png) [@faridmmv](https://discuss.elastic.co/u/faridmmv)\ **Post date:** [January 29, 2020, 9:02pm UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/7 "2020-01-29T21:02:02Z")
Any suggestions? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 30, 2020, 1:12am UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/8 "2020-01-30T01:12:32Z")
You made the grok conditional upon the value of the [type] being syslog, but the [type] field does not exist either, so the grok filter never gets applied. ---
**Author:** ![faridmmv](https://avatars.discourse-cdn.com/v4/letter/f/0ea827/32.png) [@faridmmv](https://discuss.elastic.co/u/faridmmv)\ **Post date:** [January 30, 2020, 5:43am UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/9 "2020-01-30T05:43:02Z")
I kinda understood, this config was taken from internet as part of configuration. Could you please suggest configuration to achieve same time in @timestamp and message? Thanks ---
**Author:** ![faridmmv](https://avatars.discourse-cdn.com/v4/letter/f/0ea827/32.png) [@faridmmv](https://discuss.elastic.co/u/faridmmv)\ **Post date:** [January 30, 2020, 5:53am UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/10 "2020-01-30T05:53:49Z")
I tried this config. But issue still persists ``` input { beats { port => 5044 } } filter { grok { match => ["message", "%{TIMESTAMP_ISO8601:timestamp}"] } date { match => ["timestamp", "ISO8601"] } } output { elasticsearch { hosts => ["localhost:9200"] index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 30, 2020, 5:52pm UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/11 "2020-01-30T17:52:31Z")
> [@faridmmv](#): > > "message": "29-01-2020 21:38:12.170 [http-nio-8000-exec-499] ... That date/time does not match TIMESTAMP\_ISO8601, which has to be year followed by month followed by day. ``` grok { match => ["message", "%{DATESTAMP:timestamp}"] } ``` will work. Your date filter also needs to change since, as I said, it's not in ISO8601 format. ---
**Author:** ![faridmmv](https://avatars.discourse-cdn.com/v4/letter/f/0ea827/32.png) [@faridmmv](https://discuss.elastic.co/u/faridmmv)\ **Post date:** [January 31, 2020, 5:37am UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/12 "2020-01-31T05:37:45Z")
Config below worked: input { beats { port =\> 5044 } } filter { grok { match =\> ["message", "%{DATESTAMP:timestamp}"] } date { match =\> ["timestamp" , "dd-MM-yyyy HH:mm:ss.SSS"] } } output { elasticsearch { hosts =\> ["localhost:9200"] index =\> "%{[@metadata][beat]}-%{+dd-MM-yyyy}" } } Thanks for help @Badger ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 28, 2020, 5:37am UTC](https://discuss.elastic.co/t/time-mismatch-timestamp-and-message/216999/13 "2020-02-28T05:37:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.