# @Timestamp is not matching event timestamp \_dateparsefailure
**URL:** https://discuss.elastic.co/t/timestamp-is-not-matching-event-timestamp-dateparsefailure/344506
**Category:** Logstash
**Created:** [October 5, 2023, 6:13pm UTC](https://discuss.elastic.co/t/timestamp-is-not-matching-event-timestamp-dateparsefailure/344506 "2023-10-05T18:13:37Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Cara410](https://discuss.elastic.co/u/Cara410)
#### Post date: [October 5, 2023, 6:13pm UTC](https://discuss.elastic.co/t/timestamp-is-not-matching-event-timestamp-dateparsefailure/344506/1 "2023-10-05T18:13:37Z")
Hello All,
I am having filebeat send data through logstash and I have been unable to get the @timestamp to match the event time. I get a \_dateparsefailure tag in Kibana. Everything else is ingesting as intended. I have tried everything I can think of to get it to work. I've read through the discussion posts on this, the documentation, and I am still stumped.
Here is a filter block with the timestamp info. I have other grok written after this and some mutates but they are not related to the timestamp.
```auto
filter {
if "MMM" in[tags] {
grok {
match => {
"message" => [
"^(?m)\{\"Timestamp\":\"%{TIMESTAMP_ISO8601:tstamp}\"\,%{GREEDYDATA:json_data}"
]
}
}
date {
match => ["tstamp", "yyyy-MM-dd HH:mm:ssss", "ISO8601"]
}
```
Then there are more groks that all seem to be working perfectly. We are using the json filter to parse the data.
Here are a few sample log lines.
```auto
{"Timestamp":"2023-10-02 08:00:04.3445", "Message":"Assembly Version 1.0.0.1","Caller":{"Class":"Session","Method":"LogNewSession"},"MMM":{"ID":"200","Supposition Number":"0","Application Name":"MMMSandCastle"}}
{"Timestamp":"2023-10-02 08:00:04.3455", "Message":"MMM ID: 200, Location: JanuaryFirstTest, Mode: SCTEST","Caller":{"Class":"Session","Method":"LogNewSession"},"MMM":{"ID":"200","Supposition Number":"0","Application Name":"MMMSandCastle"}}
{"Timestamp":"2023-10-02 08:00:04.3505", "Message":"Clear InSession Flag","Caller":{"Class":"<>c","Method":"b__55_0"},"MMM":{"ID":"200","Supposition Number":"0","Application Name":"MMMSandCastle"}}
{"Timestamp":"2023-10-02 08:00:04.3594", "Message":"Filling out accessible options for form Welcome, castle type VR","Caller":{"Class":"FormController","Method":"SetupAccessibilityControls"},"MMM":{"ID":"200","Supposition Number":"0","Application Name":"MMMSandCastle"}}
{"Timestamp":"2023-10-02 08:00:04.3743", "Message":"Error Retrieving ConfigSettings for Key: Sand_Threshold","Caller":{"Class":"ConfigSettings","Method":"GetValue"},"MMM":{"ID":"200","Supposition Number":"0","Application Name":"MMMSandCastle"}}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 5, 2023, 6:58pm UTC](https://discuss.elastic.co/t/timestamp-is-not-matching-event-timestamp-dateparsefailure/344506/2 "2023-10-05T18:58:57Z")
Try
```
date { match => ["tstamp", "yyyy-MM-dd HH:mm:ss.SSSS"] }
```
You may then find it useful to add
```
mutate { gsub => ["json_data", "^", "{"] }
json { source => "json_data" }
```
---
### Author:  [@Cara410](https://discuss.elastic.co/u/Cara410)
#### Post date: [October 5, 2023, 8:01pm UTC](https://discuss.elastic.co/t/timestamp-is-not-matching-event-timestamp-dateparsefailure/344506/3 "2023-10-05T20:01:48Z")
Thank you Badger! I appreciate your quick response!
It is working now. I can't believe it was just that one little thing!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 2, 2023, 8:01pm UTC](https://discuss.elastic.co/t/timestamp-is-not-matching-event-timestamp-dateparsefailure/344506/4 "2023-11-02T20:01:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.