# @timestamp field not matching with the Actual log field in Kibana
**URL:** https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field-in-kibana/49511
**Category:** Logstash
**Created:** [May 9, 2016, 5:41am UTC](https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field-in-kibana/49511 "2016-05-09T05:41:36Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Rohit\_Singh](https://discuss.elastic.co/u/Rohit_Singh)
#### Post date: [May 9, 2016, 5:41am UTC](https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field-in-kibana/49511/1 "2016-05-09T05:41:36Z")
Continuing the discussion from [@timestamp field not matching with the Actual log field](https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field/343):
Hi, I have been using ELK for quite a sometime now. My logs are in following pattern
May 9 03:45:25 rjedi-04 docker/3fdf29fdc1eb[8054]: 2016-05-09 03:45:25,940 [main] INFO ly.stealth.mesos.kafka.HttpServer$ - started on port 4239
my logstash conf is
grok {
match =\> { "message" =\> "%{CISCOTIMESTAMP:syslog\_timestamp} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{URIHOST:date\_value} %{TIME:time\_value}%{GREEDYDATA:syslog\_message}" }
add\_field =\> { "primary\_timestamp" =\> "%{date\_value} %{time\_value}" }
add\_field =\> { "is\_matched" =\> "true" }
add\_field =\> { "received\_from" =\> "%{host}" }
add\_field =\> { "is\_primary\_tstmp" =\> "true" }
}
date {
match =\> ["primary\_timestamp", "YYYY-MM-dd HH:mm:ss','SSS", "YYYY-MM-dd HH:mm:ss'.'SSS", "YYYY-MM-dd HH:mm:ss':'SSS"]
target =\> "@timestamp"
remove\_field =\> ["time\_value", "date\_value", "primary\_timestamp"]
}
```
if "_dateparsefailure" in [tags] {
date {
match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
target => "@timestamp"
}
}
```
When ever Logstash parses the logs @timestamp value is 2016-05-09T03:45:25.940Z
{
"message" =\> "May 9 03:45:25 rjedi-04 docker/3fdf29fdc1eb[8054]: 2016-05-09 03:45:25,940 [main] INFO ly.stealth.mesos.kafka.HttpServer$ - started on port 4239",
"@version" =\> "1",
"@timestamp" =\> "2016-05-09T03:45:25.940Z",
"host" =\> "[test.hello.com](http://test.hello.com)",
"syslog\_timestamp" =\> "May 9 03:45:25",
"syslog\_hostname" =\> "rjedi-04",
"syslog\_program" =\> "docker/3fdf29fdc1eb",
"syslog\_pid" =\> "8054",
"syslog\_message" =\> " [main] INFO ly.stealth.mesos.kafka.HttpServer$ - started on port 4239",
"is\_matched" =\> "true",
"received\_from" =\> "[test.hello.com](http://test.hello.com)",
"is\_primary\_tstmp" =\> "true"
}
However same is not reflected on Kibana , in kibana it is showing as May 9th 2016, 09:15:25.940
All of my ELK stack is in UTC timezone. I am unable to find where is it being changed, as Kibana accepts UTC timestamp, and ideally it shouldn't modify, correct me if i am wrong.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 9, 2016, 5:49am UTC](https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field-in-kibana/49511/2 "2016-05-09T05:49:56Z")
By default Kibana converts timestamps to the browser's local timezone, and you're apparently in UTC+5:30.
---
### Author:  [@Rohit\_Singh](https://discuss.elastic.co/u/Rohit_Singh)
#### Post date: [May 9, 2016, 6:00am UTC](https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field-in-kibana/49511/3 "2016-05-09T06:00:42Z")
The time reflected is correct then, yes i am in UTC+5.30 time zone.
Thanks for the quick update
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field-in-kibana/49511/4 "2017-07-06T04:58:39Z")