# Timestamp error

**URL:** https://discuss.elastic.co/t/timestamp-error/124412
**Category:** Beats
**Tags:** filebeat
**Created:** [March 17, 2018, 6:20pm UTC](https://discuss.elastic.co/t/timestamp-error/124412 "2018-03-17T18:20:38Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![space.iitr](https://avatars.discourse-cdn.com/v4/letter/s/ecae2f/32.png) [@space.iitr](https://discuss.elastic.co/u/space.iitr)
#### Post date: [March 17, 2018, 6:20pm UTC](https://discuss.elastic.co/t/timestamp-error/124412/1 "2018-03-17T18:20:38Z")

</div>

I am getting wrong value in @timestamp field for elasticsearch/filebeat. My filebeat pipeline definition

```
curl -H 'Content-Type: application/json' -XPUT "logger:9200/_ingest/pipeline/app_log" -d'
{
  "description" : "Ingest pipeline for Jetty server log",
  "processors" : [
    {
      "grok": {
        "field": "message",
        "patterns": ["%{TIMESTAMP_ISO8601:timestamp} (%{UUID:accessid})? \\[(?<threadname>[^\\]]+)\\] %{LOGLEVEL:level} %{DATA:classname} - %{GREEDYDATA:message}"]
      }
    },
    {
      "date": {
        "field": "timestamp",
        "formats": ["yyyy-mm-dd H:m:s,SSS"]
      }
    }
  ],
  "on_failure" : [{
    "set" : {
      "field" : "error.message",
      "value" : "{{ _ingest.on_failure_message }}"
    }
  }]
}'

```

Simulation result for some sample logger line. ( Using logback configuration )

curl -H 'Content-Type: application/json' -XPOST "logger:9200/\_ingest/pipeline/app\_log/\_simulate?pretty" -d'  
{  
"docs": [  
{  
"\_source": {  
"message": "2018-03-17 22:38:39,079 bab3157d-a11c-4dba-a6d6-c47ae0de2b7f [qtp224100622-174782] INFO i.n.core.services.cache.CacheBuilder - Key : ChIJrTTTJkdsrjsRXkrYRKRRfd8-seo-localitiesv1 is returned from cache"

```
  }
},
{
  "_source": {
    "message": "2017-12-12 01:14:12,079 [qtp224100622-185269] WARN i.n.m.cache.sdk.RedisCacheProvider - No matching policy: class in.nobroker.core.domain.Token"
  }
}

```

]  
}'  
The result from this simulation:

{ "docs" : [{ "doc" : { "\_index" : "\_index", "\_type" : "\_type", "\_id" : "\_id", "\_source" : { "accessid" : "bab3157d-a11c-4dba-a6d6-c47ae0de2b7f", "@timestamp" : "2018-01-17T22:38:39.079Z", "classname" : " i.n.core.services.cache.CacheBuilder", "level" : "INFO", "message" : "Key : ChIJrTTTJkdsrjsRXkrYRKRRfd8-seo-localitiesv1 is returned from cache", "timestamp" : "2018-03-17 22:38:39,079", "threadname" : "qtp224100622-174782" }, "\_ingest" : { "timestamp" : "2018-03-17T15:35:35.543Z" } } }, { "doc" : { "\_index" : "\_index", "\_type" : "\_type", "\_id" : "\_id", "\_source" : { "@timestamp" : "2017-01-12T01:14:12.079Z", "classname" : " i.n.m.cache.sdk.RedisCacheProvider", "level" : "WARN", "message" : "No matching policy: class in.nobroker.core.domain.Token", "timestamp" : "2017-12-12 01:14:12,079", "threadname" : "qtp224100622-185269" }, "\_ingest" : { "timestamp" : "2018-03-17T15:35:35.543Z" } } }] }

Please notice that @timestamp field is totally different from timestamp field.

> <https://stackoverflow.com/questions/49338676/incorrect-timestamp-by-date-processor-in-elasticsearch-filebeat>

---

<div class="post-metadata">

### Author: ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [March 20, 2018, 9:13am UTC](https://discuss.elastic.co/t/timestamp-error/124412/2 "2018-03-20T09:13:01Z")

</div>

You seem to parse the `timestamp` field but never put it in `@timestamp`? Try adding `"target_field": "@timestamp"`. Here is an [example](https://github.com/elastic/beats/blob/master/filebeat/module/apache2/access/ingest/default.json#L22-L26) from our modules.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 17, 2018, 9:13am UTC](https://discuss.elastic.co/t/timestamp-error/124412/3 "2018-04-17T09:13:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.