# @timestamp not set when parsing nginx logs

**URL:** <https://discuss.elastic.co/t/timestamp-not-set-when-parsing-nginx-logs/35432>\
**Category:** Logstash\
**Created:** [November 24, 2015, 10:17am UTC](https://discuss.elastic.co/t/timestamp-not-set-when-parsing-nginx-logs/35432 "2015-11-24T10:17:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jon\_black](https://avatars.discourse-cdn.com/v4/letter/j/48db29/32.png) [@jon\_black](https://discuss.elastic.co/u/jon_black)\
**Post date:** [November 24, 2015, 10:17am UTC](https://discuss.elastic.co/t/timestamp-not-set-when-parsing-nginx-logs/35432/1 "2015-11-24T10:17:33Z")

</div>

For a long time I assumed @timestamp was being parsed correctly; the time in the kibana Time field matches the @timestamp field, which matched the data being logged; however, logstash crashed over the weekend so I started it up this morning, and all the missed logs have @timestamp set to today, completely different to the time in the log.

I'm using the following pattern...

```
%{IPORHOST:clientip} %{NGUSER:ident} %{NGUSER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response} (?:%{NUMBER:bytes}|-) (?:"(?:%{URI:referrer}|-)"|%{QS:referrer})(?:;|) %{QS:agent}

```

...which the grok debugger seems to be fine with (some data removed)...

```
{
"timestamp": [
  [
    "22/Nov/2015:08:00:43 +0100"
  ]
],
"MONTHDAY": [
  [
    "22"
  ]
],
"MONTH": [
  [
    "Nov"
  ]
],
"YEAR": [
  [
    "2015"
  ]
],
"TIME": [
  [
    "08:00:43"
  ]
],
"HOUR": [
  [
    "08"
  ]
],
"MINUTE": [
  [
    "00"
  ]
],
"SECOND": [
  [
    "43"
  ]
],
"INT": [
  [
    "+0100"
  ]
],

```

...when parsing the following...

```
x.x.x.x - - [22/Nov/2015:08:00:43 +0100] "GET /secret HTTP/1.1" 304 0 "" "Mozilla/5.0 (Windows NT 6.1; rv:42.0) Gecko/20100101 Firefox/42.0"
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 24, 2015, 12:32pm UTC](https://discuss.elastic.co/t/timestamp-not-set-when-parsing-nginx-logs/35432/2 "2015-11-24T12:32:14Z")

</div>

The grok filter doesn't populate `@timestamp`, that's the job of the date filter. Do you have a date filter, and if yes, how is it configured?

---

<div class="post-metadata">

**Author:** ![jon\_black](https://avatars.discourse-cdn.com/v4/letter/j/48db29/32.png) [@jon\_black](https://discuss.elastic.co/u/jon_black)\
**Post date:** [November 24, 2015, 12:35pm UTC](https://discuss.elastic.co/t/timestamp-not-set-when-parsing-nginx-logs/35432/3 "2015-11-24T12:35:53Z")

</div>

That'll be my mistake then. I assumed since I parsed it correctly with grok and I had an @timestamp field in the index, that it was done for me.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:21am UTC](https://discuss.elastic.co/t/timestamp-not-set-when-parsing-nginx-logs/35432/4 "2017-07-06T05:21:32Z")

</div>

Closed on July 6, 2017, 5:21am UTC