# @timestamp not match with the log date

**URL:** <https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/262272>\
**Category:** Logstash\
**Created:** [January 26, 2021, 7:14pm UTC](https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/262272 "2021-01-26T19:14:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Riyanka](https://avatars.discourse-cdn.com/v4/letter/r/cdc98d/32.png) [@Riyanka](https://discuss.elastic.co/u/Riyanka)\
**Post date:** [January 26, 2021, 7:14pm UTC](https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/262272/1 "2021-01-26T19:14:43Z")

</div>

The timestamp does not match with the actual log time in kibana  
@timestamp January 26th 2021, 23:38:10.426  
message [2021-01-22 09:53:09] php.CRITICAL: Uncaught Error: Call to a member function getName() on null {"exception":"[object] (Error(code: 0): Call to a member function getName() on null at /var/www/html/vendor/bundles/AdminBundle/Controller/AdminController.php:78)"}   
Below is my logstash configuration  
input {  
beats {  
port =\> "5044"  
ssl =\> false  
}  
}  
filter {  
date {  
match =\> ["message" , "yyyy-MM-dd HH:mm:ss"]  
target =\> "@timestamp"  
locale =\> "en"  
timezone =\> "GMT"  
}  
Could you please help me with the configurations.

Sample log:[2021-01-22 09:53:09] php.CRITICAL: Uncaught Error: Call to a member function getName() on null {"exception":"[object] (Error(code: 0): Call to a member function getName() on null at /var/www/html/vendor/bundles/AdminBundle/Controller/AdminController.php:78)"}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 26, 2021, 8:58pm UTC](https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/262272/2 "2021-01-26T20:58:45Z")

</div>

The pattern in the date filter has to match the entire contents of the field that you pass it, so you will need to extract the date from [message]. You could try

```
dissect { mapping => { "message" => "%{}[%{[@metadata][date]}]%{}" } }
date { match => ["[@metadata][date]", "yyyy-MM-dd HH:mm:ss" ] }
```

---

<div class="post-metadata">

**Author:** ![Riyanka](https://avatars.discourse-cdn.com/v4/letter/r/cdc98d/32.png) [@Riyanka](https://discuss.elastic.co/u/Riyanka)\
**Post date:** [January 27, 2021, 12:15pm UTC](https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/262272/3 "2021-01-27T12:15:58Z")

</div>

Hi Badger  
Thank you for the quick reply i am getting this below error now while running logstash  
[WARN] 2021-01-27 12:10:57.688 [nioEventLoopGroup-2-10] DefaultChannelPipeline - An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.  
io.netty.handler.codec.DecoderException: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 69

This is my beats configuration  
filebeat.inputs:  
- type: log  
enabled: true  
paths:  
- /root/prod.log  
output.logstash:  
hosts: ["localhost:5044"]

And this my logstash configuration  
input {  
beats {  
port =\> "5044"  
ssl =\> false  
}  
}  
filter {  
grok {  
match =\> { "message" =\> "[%{TIMESTAMP\_ISO8601:timestamp}]{0,1}%{GREEDYDATA:Message}" }  
}  
dissect {  
mapping =\> { "message" =\> "%{}[%{[@metadata][date]}]%{}" }  
}  
date {  
match =\> ["[@metadata][date]", "yyyy-MM-dd HH:mm:ss" ]  
}  
}

Could you please help on this

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 27, 2021, 4:46pm UTC](https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/262272/4 "2021-01-27T16:46:34Z")

</div>

> [@Riyanka](#):
>
> org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 69

Generally this means that something that is not speaking the beats protocol is connecting to the input. Amongst the possible causes are:

1. A beat with SSL enabled connecting to a beat input with SSL disabled
2. A beat with SSL disabled connecting to a beat input with SSL enabled
3. A port scanner (on the public internet you can be certain that folks are port scanning you, on a corporate network this may also happen)
4. Someone else trying to use the same port

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 24, 2021, 4:47pm UTC](https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/262272/5 "2021-02-24T16:47:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.