# Timestamp and @timestamp problem with a big gap

**URL:** <https://discuss.elastic.co/t/timestamp-and-timestamp-problem-with-a-big-gap/27948>\
**Category:** Logstash\
**Created:** [August 24, 2015, 12:55pm UTC](https://discuss.elastic.co/t/timestamp-and-timestamp-problem-with-a-big-gap/27948 "2015-08-24T12:55:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![michaelzoet](https://avatars.discourse-cdn.com/v4/letter/m/dbc845/32.png) [@michaelzoet](https://discuss.elastic.co/u/michaelzoet)\
**Post date:** [August 24, 2015, 12:55pm UTC](https://discuss.elastic.co/t/timestamp-and-timestamp-problem-with-a-big-gap/27948/1 "2015-08-24T12:55:41Z")

</div>

Hello all,

I have a Logstash, Elasticsearch, Kibana, Logstash-forwarder setup running. Now I found a problem with the timestamp and @timestamp mismatch on some logfile types. I have no issue with syslog, Apache and PostgreSQL logs. But with all JAVA driven log types like Tomcat, Zuul and Eureka (and some microservices using Zuul and Eureka),

For example there is the following entry in logstash.log:

# ===================== { "message" =\> "2015-08-24 14:20:21.282 INFO 3167 --- [ReplicaAwareInstanceRegistry - RenewalThresholdUpdater] c.n.eureka.PeerAwareInstanceReg istry : Current renewal threshold is : 64", "@version" =\> "1", "@timestamp" =\> "2015-01-24T13:20:21.282Z", "file" =\> "/var/log/eureka/eureka-server.log", "host" =\> "microgw-01", "offset" =\> "5730664", "server\_location" =\> "01", "type" =\> "eureka", "fqdn" =\> "[microgw-01.example.com](http://microgw-01.example.com)", "role" =\> "microgw", "stage" =\> "production", "server\_type" =\> "XL", "timestamp" =\> "2015-08-24 14:20:21.282", "eureka\_log\_level" =\> "INFO", "eureka\_process\_id" =\> "3167", "eureka\_thread\_name" =\> "ReplicaAwareInstanceRegistry - RenewalThresholdUpdater", "eureka\_java\_class\_name" =\> "c.n.eureka.PeerAwareInstanceRegistry : Current renewal threshold is ", "eureka\_log\_message" =\> "64" }

I am really wondering why I have a difference of 7 months and one hour in timestamp and @timestamp. Maybe someone can give me hints or documentation links to sort this?

My configuration details for this logfile type in logstash.conf:

# =================== ... if [type] =~ "eureka" { multiline { patterns\_dir =\> "/etc/logstash/patterns" pattern =\> "^%{MICROSERVICETIME}" negate =\> true what =\> "next" } grok { patterns\_dir =\> "/etc/logstash/patterns" match =\> ["message", "%{EUREKALOG}"] } date { match =\> ["timestamp", "YYYY-MM-DD HH:mm:ss.SSS"] timezone =\> "Europe/Berlin" } } ...

And the extra patterns:

===================

MICROSERVICETIME %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})

EUREKALOG ^%{MICROSERVICETIME:timestamp}%{SPACE}%{LOGLEVEL:eureka\_log\_level}%{SPACE}%{NUMBER:eureka\_process\_id}%{SPACE}---%{SPACE}[%{GREEDYDATA:eureka\_thread\_name}]%{SPACE}%{GREEDYDATA:eureka\_java\_class\_name}%{SPACE}:%{SPACE}%{GREEDYDATA:eureka\_log\_message}$

===================

I hope someone can help me on this because at the moment "I do not see the forest for the trees" 😉 on this.

Thanks,  
Michael

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 24, 2015, 1:34pm UTC](https://discuss.elastic.co/t/timestamp-and-timestamp-problem-with-a-big-gap/27948/2 "2015-08-24T13:34:50Z")

</div>

I can't explain _why_ this happens, but the `DD` in your pattern actually means "day of year" and not "day of month", and for whatever reason this changes how the preceding MM is interpreted. The pattern `YYYY-MM-dd HH:mm:ss.SSS` works for me.

---

<div class="post-metadata">

**Author:** ![michaelzoet](https://avatars.discourse-cdn.com/v4/letter/m/dbc845/32.png) [@michaelzoet](https://discuss.elastic.co/u/michaelzoet)\
**Post date:** [August 24, 2015, 2:46pm UTC](https://discuss.elastic.co/t/timestamp-and-timestamp-problem-with-a-big-gap/27948/3 "2015-08-24T14:46:36Z")

</div>

Oh yeah... Thanks a lot! That was the problem and now it works like a charm.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:31am UTC](https://discuss.elastic.co/t/timestamp-and-timestamp-problem-with-a-big-gap/27948/4 "2017-07-06T05:31:04Z")

</div>