# @timestamp field is not converting PM time to correct UTC

**URL:** https://discuss.elastic.co/t/timestamp-field-is-not-converting-pm-time-to-correct-utc/223602
**Category:** Logstash
**Created:** [March 14, 2020, 5:47am UTC](https://discuss.elastic.co/t/timestamp-field-is-not-converting-pm-time-to-correct-utc/223602 "2020-03-14T05:47:18Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Vinutha\_A\_H](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinutha_a_h/32/48343_2.png) [@Vinutha\_A\_H](https://discuss.elastic.co/u/Vinutha_A_H)
#### Post date: [March 14, 2020, 5:47am UTC](https://discuss.elastic.co/t/timestamp-field-is-not-converting-pm-time-to-correct-utc/223602/1 "2020-03-14T05:47:18Z")

</div>

Hi,

In our logs, we have our date time as below and trying to set the same to timestamp field in logstash. It's giving correct UTC time for AM timings but not converting to right UTC time for PM timings.

Logs : the below data is mapped as Date, Time, half-day using grok filter.  
//  
03/11/20 09:36:58 AM

03/11/20 09:36:58 PM

03/11/20 02:08:31 PM  
//

Our logstash config has :  
//  
If [halfday] =~ /[AP]M/ {  
mutate { add\_field ==\> ["ts" , "%{date} %{time} %{halfday}"] }  
} else {  
mutate { add\_field ==\> ["ts" , "%{date} %{time}"] }  
}  
If [ts] =~ /date/ {  
drop { }  
}  
date {  
match =\> ["ts" , "MM/dd/yy HH:mm:ss a"]  
target =\> "@timestamp"  
}  
//

For ex : for NY time --\> 08:45:42 PM and 08:45:42 AM, timestamp shows as "13:45:42.000Z" for both.  
So, for PM time, timestamp is not converting to the right UTC time.

Any help in this is usefull. Thanks in advance.

Regards, Vinutha

---

<div class="post-metadata">

### Author: ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [March 14, 2020, 12:44pm UTC](https://discuss.elastic.co/t/timestamp-field-is-not-converting-pm-time-to-correct-utc/223602/2 "2020-03-14T12:44:04Z")

</div>

> [@Vinutha\_A\_H](#):
>
> date {  
> match =\> ["ts" , "MM/dd/yy HH:mm:ss a"]  
> target =\> "@timestamp"  
> }

Hi there,

first of all please try to properly format your message before posting or it'll be unreadable.

Anyway, try with

```
date {
  match => ["ts" , "MM/dd/yy hh:mm:ss a"]
  target => "@timestamp"
}

```

---

<div class="post-metadata">

### Author: ![Vinutha\_A\_H](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinutha_a_h/32/48343_2.png) [@Vinutha\_A\_H](https://discuss.elastic.co/u/Vinutha_A_H)
#### Post date: [March 16, 2020, 2:19pm UTC](https://discuss.elastic.co/t/timestamp-field-is-not-converting-pm-time-to-correct-utc/223602/3 "2020-03-16T14:19:08Z")

</div>

Thank you @Fabio-sama, it worked.

---

<div class="post-metadata">

### Author: ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [March 16, 2020, 2:40pm UTC](https://discuss.elastic.co/t/timestamp-field-is-not-converting-pm-time-to-correct-utc/223602/4 "2020-03-16T14:40:34Z")

</div>

No problem. Just mark it as a solution so future readers will see this thread has been solved. ù

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 13, 2020, 2:40pm UTC](https://discuss.elastic.co/t/timestamp-field-is-not-converting-pm-time-to-correct-utc/223602/5 "2020-04-13T14:40:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
