# @timestamp not match with log timestamp

**URL:** <https://discuss.elastic.co/t/timestamp-not-match-with-log-timestamp/358403>\
**Category:** Logstash\
**Created:** [April 29, 2024, 8:37am UTC](https://discuss.elastic.co/t/timestamp-not-match-with-log-timestamp/358403 "2024-04-29T08:37:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ken\_Pang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ken_pang/32/122625_2.png) [@Ken\_Pang](https://discuss.elastic.co/u/Ken_Pang)\
**Post date:** [April 29, 2024, 8:37am UTC](https://discuss.elastic.co/t/timestamp-not-match-with-log-timestamp/358403/1 "2024-04-29T08:37:54Z")

</div>

I'm new to ELK, I've search the related post here, but still unable to get my event timestamp work, anyone can help?

**my sample data**  
2024/04/29 15:46:11.833  
Dev = TTA10B6001-01, Data: Current State = ReadTagStatus, New State = WaitReadTagStatusComplete

2024/04/29 15:46:11.880  
Dev = RDR\_TTA10B6001\_01, Data: Current State = Idle, New State = WakeTag, debug info Command: ReadTagStatus

2024/04/29 15:46:11.880  
Dev = TTLRPHA002-01, Data: uiSerialNumber: 177841

**filebeat**

```auto
filebeat.inputs:
- type: filestream
  id: my-stratusserver-log
  enabled: true
  take_over: true
  paths:
    - D:\IntelliMove3\Log\Event\**\*.log
  ignore_older: 2h
  fields:
  content_type: log
  fields_under_root: true
  tags: ["log"]
  parsers:
    - multiline:
        pattern: '^[0-9]{4}\/[0-9]{2}\/[0-9]{2} [0-9]{2}\:[0-9]{2}\:[0-9]{2}\.[0-9]{3}'
        negate: true
        match: after

```

**logstash**

```auto
filebeat.inputs:

- type: filestream
  id: my-stratusserver-log
  enabled: true
  take_over: true
  paths:
    - D:\IntelliMove3\Log\Event\**\*.log
  ignore_older: 2h
  fields:
  content_type: log
  fields_under_root: true
  tags: ["log"]
  parsers:
    - multiline:
        pattern: '^[0-9]{4}\/[0-9]{2}\/[0-9]{2} [0-9]{2}\:[0-9]{2}\:[0-9]{2}\.[0-9]{3}'
        negate: true
        match: after

```

 ![elk](https://us1.discourse-cdn.com/elastic/original/3X/4/a/4a8e0184f5f2e286774802dbacd3025be1fe8276.jpeg)

---

<div class="post-metadata">

**Author:** ![Ken\_Pang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ken_pang/32/122625_2.png) [@Ken\_Pang](https://discuss.elastic.co/u/Ken_Pang)\
**Post date:** [April 29, 2024, 9:47am UTC](https://discuss.elastic.co/t/timestamp-not-match-with-log-timestamp/358403/2 "2024-04-29T09:47:58Z")

</div>

Sorry, I can't find edit post button

**logstash**

```auto
filter {
        grok {
            match => { "message" => "(?<log_datetime>%{YEAR}\/%{MONTHNUM}\/%{MONTHDAY} %{TIME})\\n%{GREEDYDATA:Data}" }
        }
        date {
            match => ["log_datetime", "yyyy/MM/dd HH:mm:ss.SSS"]
            timezone => "Singapore"
            remove_field => ["log_datetime"]
        }

```