# Timestamp problem created using dissect

**URL:** <https://discuss.elastic.co/t/timestamp-problem-created-using-dissect/157782>\
**Category:** Logstash\
**Created:** [November 21, 2018, 10:06pm UTC](https://discuss.elastic.co/t/timestamp-problem-created-using-dissect/157782 "2018-11-21T22:06:51Z")\
**Posts on this page:** 1\
**Showing post:** 15

<div class="post-metadata">

**Author:** ![RussellBateman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russellbateman/32/34928_2.png) [@RussellBateman](https://discuss.elastic.co/u/RussellBateman)\
**Post date:** [November 23, 2018, 3:50pm UTC](https://discuss.elastic.co/t/timestamp-problem-created-using-dissect/157782/15 "2018-11-23T15:50:57Z")

</div>

I'm in development; I can do anything I want (and can figure out how) to do.

Where do I set the type of this field seeing as I only create it in the `dissect` filter thus (see below) in the first place? (Filebeat sent it in as a subset of the `message` field originally. Without my filter, `acme.date` doesn't exist.) Is there additional syntax I can decorate this code with that will accomplish it?

```
filter
{
  dissect
  {
    mapping =>
    {
      "message" => "%{acme.date} %{acme.time} CEF:%{acme.version}|%{acme.device_vendor}|%{acme.device_product}|%{acme.device_version}|%{acme.device_event_class_id}|%{acme.name}|%{acme.severity}|%{acme.extensions}"
    }
  }
}
```

---

_[View the full topic](https://discuss.elastic.co/t/timestamp-problem-created-using-dissect/157782)._