# Timestamp fails for filebeat haproxy @SSL handshake failure loglines its displayed one houre in the future in kibana

**URL:** <https://discuss.elastic.co/t/timestamp-fails-for-filebeat-haproxy-ssl-handshake-failure-loglines-its-displayed-one-houre-in-the-future-in-kibana/222470>\
**Category:** Elasticsearch\
**Created:** [March 6, 2020, 1:55pm UTC](https://discuss.elastic.co/t/timestamp-fails-for-filebeat-haproxy-ssl-handshake-failure-loglines-its-displayed-one-houre-in-the-future-in-kibana/222470 "2020-03-06T13:55:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![seb0](https://avatars.discourse-cdn.com/v4/letter/s/ecccb3/32.png) [@seb0](https://discuss.elastic.co/u/seb0)\
**Post date:** [March 6, 2020, 1:55pm UTC](https://discuss.elastic.co/t/timestamp-fails-for-filebeat-haproxy-ssl-handshake-failure-loglines-its-displayed-one-houre-in-the-future-in-kibana/222470/1 "2020-03-06T13:55:13Z")

</div>

Hello, i have a problem with filebeat haproxy module.

All logs are parsed directly from filebeat 7.5.0 to elk 7.5.0 but the Lines with SSL handshakre failure are displayed on hour in the future.

Here my json output:

```auto
{
  "_index": "filebeat-7.5.0-2020.03.05-000024",
  "_type": "_doc",
  "_id": "CGQTsHAB44abDEp1fnUS",
  "_version": 1,
  "_score": null,
  "_source": {
    "agent": {
      "hostname": "haproxy",
      "id": "4d23cae7-e2c2-4c29-b545- **** 252b05b",
      "type": "filebeat",
      "ephemeral_id": "b479422c-1d86- *****-**** -b657cbc1cc08",
      "version": "7.5.0"
    },
    "process": {
      "name": "haproxy",
      "pid": 7678
    },
    "log": {
      "file": {
        "path": "/var/log/haproxy.log"
      },
      "offset": 177032605
    },
    "source": {
      "geo": {
        "continent_name": " ****",
        "region_iso_code": " ****",
        "city_name": "***",
        "country_iso_code": "**",
        "region_name": " ******",
        "location": {
          "lon": ***,
          "lat": ****
        }
      },
      "as": {
        "number": 3320,
        "organization": {
          "name": " *****"
        }
      },
      "address": " *****",
      "port": ***** ,
      "ip": " *****"
    },
    "fileset": {
      "name": "log"
    },
    "input": {
      "type": "log"
    },
    "@timestamp": "2020-03-06T14:40:30.478Z",
    "ecs": {
      "version": "1.1.0"
    },
    "service": {
      "type": "haproxy"
    },
    "host": {
      "hostname": "haproxy",
      "os": {
        "kernel": " *****",
        "codename": " ****",
        "name": " ****",
        "family": " ****",
        "version": " ***** 1*.0*",
        "platform": "***"
      },
      "containerized": false,
      "name": "haproxy",
      "id": "01fabdf80b364fa1a051196c3be9e04f",
      "architecture": "x86_64"
    },
    "haproxy": {
      "error_message": "SSL handshake failure",
      "bind_name": "1:",
      "frontend_name": " **** SSL"
    },
    "event": {
      "module": "haproxy",
      "dataset": "haproxy.log"
    }
  },
  "fields": {
    "suricata.eve.timestamp": [
      "2020-03-06T14:40:30.478Z"
    ],
    "@timestamp": [
      "2020-03-06T14:40:30.478Z"
    ]
  },
  "highlight": {
    "haproxy.error_message": [
      "SSL handshake @kibana-highlighted-field@failure@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1583505630478
  ]
}

```

Here you can see the wrong timestamp.

 ![Screenshot from 2020-03-06 14-48-11](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e544d126433821aa1b8fe0a51420499325600632.png)

Can you help me to understand and maybe fixing it?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 3, 2020, 2:00pm UTC](https://discuss.elastic.co/t/timestamp-fails-for-filebeat-haproxy-ssl-handshake-failure-loglines-its-displayed-one-houre-in-the-future-in-kibana/222470/2 "2020-04-03T14:00:12Z")

</div>

Closed on April 3, 2020, 2:00pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.