# Timestamp not mapping with event time

**URL:** <https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976>\
**Category:** Logstash\
**Created:** [December 17, 2020, 11:00am UTC](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976 "2020-12-17T11:00:23Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![bharat1](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@bharat1](https://discuss.elastic.co/u/bharat1)\
**Post date:** [December 17, 2020, 11:00am UTC](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976/1 "2020-12-17T11:00:23Z")

</div>

My logs are exported in csv format and uploaded. The first column name called "Event Time" has following format event time followed by rest of the comma separated columns - "2020/11/10 00:00:00 CET"

I am not able to match @timestamp with the above log event time. Actually I want to replace the @timestamp with the above event time but the @timestamp is always showing as index creation or the data loaded time.

Below is what I have in filter that is not working. Can someone help I tried with several other combinations but was not working

```auto
filter {
    {
   date { match => ["Event Time", "yyyy/mm/dd HH:mm:ss Z"]
          target => "@timestamp"
        }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 17, 2020, 2:00pm UTC](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976/2 "2020-12-17T14:00:07Z")

</div>

> [@bharat1](#):
>
> `match => ["Event Time", "yyyy/mm/dd HH:mm:ss Z"`

Try `"yyyy/MM/dd HH:mm:ss Z"`

---

<div class="post-metadata">

**Author:** ![bharat1](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@bharat1](https://discuss.elastic.co/u/bharat1)\
**Post date:** [December 17, 2020, 6:36pm UTC](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976/3 "2020-12-17T18:36:24Z")

</div>

No luck @Badger still not working, below is my code

```auto
filter {
    csv {
       separator => ","
       columns => ["Event Time", "Event2", "Event3"]
        }
   date { match => ["Event Time", "yyyy/MM/dd HH:mm:ss Z"] }
}

```

Log line sample

```auto
"2020/11/10 00:00:00 CET","2020/11/10 00:00:00 CET","192.168.1.10".....

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 17, 2020, 7:07pm UTC](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976/4 "2020-12-17T19:07:22Z")

</div>

Z is for timezone offsets without a colon, such as -0700. You have a timezone name. Try `"yyyy/MM/dd HH:mm:ss ZZZ"`.

---

<div class="post-metadata">

**Author:** ![bharat1](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@bharat1](https://discuss.elastic.co/u/bharat1)\
**Post date:** [December 17, 2020, 7:29pm UTC](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976/5 "2020-12-17T19:29:38Z")

</div>

Post that change no data is visible. Got below error however the logstash is running

```auto
[2020-12-18T06:18:46,730][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2020-12-18T06:18:46,867][WARN][logstash.filters.csv][main][f2b1efd928c7b7891ecf22895c965305a8a857d09e257a38caae1d86bd037669] Error parsing csv {:field=>"message", :source=>"A TCP connection between two hosts was deleted", :exception=>#<NoMethodError: undefined method `empty?' for nil:NilClass>}
[2020-12-18T06:18:46,904][WARN][logstash.filters.csv][main][f2b1efd928c7b7891ecf22895c965305a8a857d09e257a38caae1d86bd037669] Error parsing csv {:field=>"message", :source=>"A UDP connection slot between two hosts was deleted", :exception=>#<NoMethodError: undefined method `empty?' for nil:NilClass>}
[2020-12-18T06:18:46,914][WARN][logstash.filters.csv][main][f2b1efd928c7b7891ecf22895c965305a8a857d09e257a38caae1d86bd037669] Error parsing csv {:field=>"message", :source=>"A UDP connection slot between two hosts was deleted", :exception=>#<NoMethodError: undefined method `empty?' for nil:NilClass>}
[2020-12-18T06:18:46,922][WARN][logstash.filters.csv][main][f2b1efd928c7b7891ecf22895c965305a8a857d09e257a38caae1d86bd037669] Error parsing csv {:field=>"message", :source=>"", :exception=>#<NoMethodError: undefined method `empty?' for nil:NilClass>}
[2020-12-18T06:18:46,925][WARN][logstash.filters.csv][main][1aba530ae982a28939d95fcd27f39e82a105f6039e1b332ef60e87326ffec1ff] Error parsing csv {:field=>"message", :source=>"", :exception=>#<NoMethodError: undefined method `each_index' for nil:NilClass>}
[2020-12-18T06:18:46,930][WARN][logstash.filters.csv][main][f2b1efd928c7b7891ecf22895c965305a8a857d09e257a38caae1d86bd037669] Error parsing csv {:field=>"message", :source=>"", :exception=>#<NoMethodError: undefined method `empty?' for nil:NilClass>}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 17, 2020, 8:10pm UTC](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976/6 "2020-12-17T20:10:35Z")

</div>

Those errors are just telling you that the [message] field does not contain a comma, so the CSV.parse\_line function returns nil.

---

<div class="post-metadata">

**Author:** ![bharat1](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@bharat1](https://discuss.elastic.co/u/bharat1)\
**Post date:** [December 23, 2020, 3:00pm UTC](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976/7 "2020-12-23T15:00:20Z")

</div>

> [@Badger](#):
>
> Z is for timezone offsets without a colon, such as -0700. You have a timezone name. Try `"yyyy/MM/dd HH:mm:ss ZZZ"` .

@Badger it did not worked. Still same issue not able to match the Event time with @timestamp. Am I missing anything in the configuration?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 20, 2021, 3:00pm UTC](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976/8 "2021-01-20T15:00:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.