# Timestamp for logstash syslog output when specifying RFC5424

**URL:** <https://discuss.elastic.co/t/timestamp-for-logstash-syslog-output-when-specifying-rfc5424/126839>\
**Category:** Logstash\
**Created:** [April 5, 2018, 5:28am UTC](https://discuss.elastic.co/t/timestamp-for-logstash-syslog-output-when-specifying-rfc5424/126839 "2018-04-05T05:28:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cplvic](https://avatars.discourse-cdn.com/v4/letter/c/f17d59/32.png) [@cplvic](https://discuss.elastic.co/u/cplvic)\
**Post date:** [April 5, 2018, 5:28am UTC](https://discuss.elastic.co/t/timestamp-for-logstash-syslog-output-when-specifying-rfc5424/126839/1 "2018-04-05T05:28:37Z")

</div>

Hi

I just started using the syslog output plugin. I am processing past logs (2017). I specified rfc =\> "rfc5424" I am also using the date filter to map the log date to @timestamp.  
On my receiving server, the timestamp shows up in rfc3164 format aka MMM dd HH:mm:ss format  
Is this expected or does specifying rfc5424 also change the format of the timestamp?

"Feb 24 01:43:17 10.255.255.59"

logstash version 6.2.3  
logstash-output-syslog 3.0.4

---

<div class="post-metadata">

**Author:** ![cplvic](https://avatars.discourse-cdn.com/v4/letter/c/f17d59/32.png) [@cplvic](https://discuss.elastic.co/u/cplvic)\
**Post date:** [April 6, 2018, 9:36pm UTC](https://discuss.elastic.co/t/timestamp-for-logstash-syslog-output-when-specifying-rfc5424/126839/2 "2018-04-06T21:36:50Z")

</div>

KKHHHHAAAAaaaaaaannnnnnnnnnnnn!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 4, 2018, 9:37pm UTC](https://discuss.elastic.co/t/timestamp-for-logstash-syslog-output-when-specifying-rfc5424/126839/3 "2018-05-04T21:37:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.