# Timestamp not taking from logs

**URL:** https://discuss.elastic.co/t/timestamp-not-taking-from-logs/140736
**Category:** Kibana
**Created:** [July 19, 2018, 1:16pm UTC](https://discuss.elastic.co/t/timestamp-not-taking-from-logs/140736 "2018-07-19T13:16:00Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![harish.sundharam](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@harish.sundharam](https://discuss.elastic.co/u/harish.sundharam)
#### Post date: [July 19, 2018, 1:16pm UTC](https://discuss.elastic.co/t/timestamp-not-taking-from-logs/140736/1 "2018-07-19T13:16:00Z")

</div>

I use to copy logs from server to local machine and I mapped log path as a local path in logstah.conf.  
Now i can able to see indexes and the log has been updated in kibana successfully, but the issue here is in Kibana its showing timestamp as my local time stamp but I want to use a timestamp which written inside my log file. Is there any way to pick timestamp from log file? Please helps me with this.

---

<div class="post-metadata">

### Author: ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)
#### Post date: [July 19, 2018, 8:47pm UTC](https://discuss.elastic.co/t/timestamp-not-taking-from-logs/140736/2 "2018-07-19T20:47:29Z")

</div>

Can do, there's two options:

1. turn off date formatting. Management -\> Index management -\> find the date field -\> click the edit icon on the rightmost column, select format as "string"
2. change the configured timezone. Management -\> advanced settings -\> dateFormat:tz

---

<div class="post-metadata">

### Author: ![harish.sundharam](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@harish.sundharam](https://discuss.elastic.co/u/harish.sundharam)
#### Post date: [July 20, 2018, 6:43am UTC](https://discuss.elastic.co/t/timestamp-not-taking-from-logs/140736/3 "2018-07-20T06:43:42Z")

</div>

I did option one but not difference still it showing timestamp when the logs moved to my local folder not the one written inside log.

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/2/d/2de6230281656e501920ed51cb4386c128b86993.JPG)

---

<div class="post-metadata">

### Author: ![vinu89](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinu89/32/45939_2.png) [@vinu89](https://discuss.elastic.co/u/vinu89)
#### Post date: [July 20, 2018, 8:51am UTC](https://discuss.elastic.co/t/timestamp-not-taking-from-logs/140736/4 "2018-07-20T08:51:07Z")

</div>

In the configuration file you can match the date which is inside the file and remove the timestamp field  
for e.g  
filter {

date {  
match =\> ["timestamp", " **dd-MMM-yyyy HH:mm:ss**"]  
remove\_field =\> ["timestamp"]  
}  
}

you have to specify the time field inside the log file.Please refer

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html)

---

<div class="post-metadata">

### Author: ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)
#### Post date: [July 20, 2018, 8:38pm UTC](https://discuss.elastic.co/t/timestamp-not-taking-from-logs/140736/5 "2018-07-20T20:38:05Z")

</div>

Thumbs up to ^. I'd check to make sure where this is happening, it looks like something at the ingest layer may be parsing the timezone. If you take a look at the raw json in your index `curl -XGET evbooking-2018.07.09/_search` you can see what it looks like without Kibana in the way.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 17, 2018, 8:38pm UTC](https://discuss.elastic.co/t/timestamp-not-taking-from-logs/140736/6 "2018-08-17T20:38:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
