# @timestamp field in Kibana is different from @timestamp field in index entry

**URL:** https://discuss.elastic.co/t/timestamp-field-in-kibana-is-different-from-timestamp-field-in-index-entry/72757
**Category:** Kibana
**Created:** [January 25, 2017, 10:37am UTC](https://discuss.elastic.co/t/timestamp-field-in-kibana-is-different-from-timestamp-field-in-index-entry/72757 "2017-01-25T10:37:31Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [January 25, 2017, 10:37am UTC](https://discuss.elastic.co/t/timestamp-field-in-kibana-is-different-from-timestamp-field-in-index-entry/72757/1 "2017-01-25T10:37:31Z")

</div>

Hi,

I have an elasticsearch index entry like;

```
{
  "_index": "myindex-2017-01-25",
  "_type": "logs",
  "_id": "AVnVKXGK2fWIWeetV6jl",
  "_score": null,
  "_source": {
	"severity": "SEVERE",
	"logtype": "mylog",
	"@timestamp": "2017-01-25T10:23:40.949Z",
	"@version": "1",
	"methodName": "getNames",
	"className": "com.school.employee.teacher",
	"message": "##SEVERE 25-Jan-2017 10:23:40.949 com.school.employee.teacher getNames user_not_found##",
	"error": " user_not_found##",
	"timestamp": "25-Jan-2017 10:23:40.949"
  },
  "fields": {
	"@timestamp": [
	  1485339820949
	]
  },
  "sort": [
	1485339820949
  ]
}

```

The timestamp in log file is `25-Jan-2017 10:23:40.949`. I am retrieving this from kafka using Logstash kafka input and i use date filter like;

```
	filter {
		grok {
			match => { "message" => "^##(?<severity>(SEVERE|INFO|WARN)) (?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) %{NOTSPACE:className} %{NOTSPACE:methodName} %{GREEDYDATA:error}" }
		}
		date {
			match => ["timestamp", "dd-MMM-yyyy HH:mm:ss.SSS"]
			timezone => "UTC"
			target => "@timestamp"
		}
	}

```

`@timestamp` and `timestamp` fields in JSON are correct, but when I look at Kibana's @timestamp field, it is `January 25th 2017, 15:53:40.949`, which is not correct. Below are the images for reference;

![](https://us1.discourse-cdn.com/elastic/original/2X/4/41ed018c9b05d86d9f693d43f2fb122ab0b3e748.PNG) ![](https://us1.discourse-cdn.com/elastic/original/2X/e/e6e4560ddc6dedf471887423e36973dea67d7718.PNG)

How can I fix this?  
Thanks in advance.

---

<div class="post-metadata">

### Author: ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [January 25, 2017, 10:42am UTC](https://discuss.elastic.co/t/timestamp-field-in-kibana-is-different-from-timestamp-field-in-index-entry/72757/2 "2017-01-25T10:42:58Z")

</div>

removed `timezone => "UTC"` and issue seems solved.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 25, 2017, 11:10am UTC](https://discuss.elastic.co/t/timestamp-field-in-kibana-is-different-from-timestamp-field-in-index-entry/72757/3 "2017-01-25T11:10:59Z")

</div>

By default Kibana adjusts the UTC time in `@timestamp` to the browser's local timezone. Make sure the time stored in `@timestamp` is UTC (and not local time) and you'll be fine.

---

<div class="post-metadata">

### Author: ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [January 25, 2017, 5:01pm UTC](https://discuss.elastic.co/t/timestamp-field-in-kibana-is-different-from-timestamp-field-in-index-entry/72757/4 "2017-01-25T17:01:56Z")

</div>

Ok, but I had `timezone => "UTC"` in my date filter and how it worked as expected after removing that tag (timezone to system default)?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 25, 2017, 6:58pm UTC](https://discuss.elastic.co/t/timestamp-field-in-kibana-is-different-from-timestamp-field-in-index-entry/72757/5 "2017-01-25T18:58:27Z")

</div>

Well, what's the timezone of the timestamps that you're parsing?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 22, 2017, 6:58pm UTC](https://discuss.elastic.co/t/timestamp-field-in-kibana-is-different-from-timestamp-field-in-index-entry/72757/6 "2017-02-22T18:58:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.