# @timestamp shows indexed date/time and not time from log entry **URL:** \ **Category:** Logstash\ **Created:** [February 9, 2017, 8:07am UTC](https://discuss.elastic.co/t/timestamp-shows-indexed-date-time-and-not-time-from-log-entry/74472 "2017-02-09T08:07:38Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![hoagieben](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoagieben/32/15366_2.png) [@hoagieben](https://discuss.elastic.co/u/hoagieben)\ **Post date:** [February 9, 2017, 8:07am UTC](https://discuss.elastic.co/t/timestamp-shows-indexed-date-time-and-not-time-from-log-entry/74472/1 "2017-02-09T08:07:38Z")
Being very new to ELK I have borrowed the following logstash config which seems to work in the main. Annoyingly though the @timestamp values are not the same as the values in the WebSphere logs but the date/time in which the index rebuilt. How do I get the @timestamp to show the actual date/time as it does for timestamp. Incidentally, timestamp shows %{tz\_num} appended which I would like to remove ![](https://us1.discourse-cdn.com/elastic/original/2X/7/729d315e974e165aca18acc441ee0422e1189d29.jpg) Here is the config input { file { path =\> ["/opt/logs/SystemOut\*.log"] start\_position =\> "beginning" type =\> "websphere" # important! logstash read only logs from files touched the last 24 hours # 8640000 = 100 days sincedb\_path =\> "/dev/null" ignore\_older =\> "8640000" } } filter { if [type] =~ "websphere" { grok { match =\> ["source", "%{GREEDYDATA}/%{GREEDYDATA:server\_name}/SystemOut.log"] } grok { match =\> ["message", "[%{DATA:wastimestamp} %{WORD:tz}] %{BASE16NUM:was\_threadID} (?\\b[A-Za-z0-9$]{2,}\b) %{SPACE}%{WORD:was\_loglevel}%{SPACE} %{GREEDYDATA:was\_msg}"] } grok { match =\> ["was\_msg", "(?\[A-Z0-9]{9,10})[:,\s\s]%{GREEDYDATA:was\_msg}"] overwrite =\> ["was\_msg"] tag\_on\_failure =\> } translate { field =\> "tz" destination =\> "tz\_num" dictionary =\> [ "CET", "+0100", "CEST", "+0200", "EDT", "-0400" ] } translate { field =\> "was\_errcode" destination =\> "was\_application" regex =\> "true" exact =\> "true" dictionary =\> [ "CLFRW", "Search", "CLFRA", "Activities", "CLFRS", "Blogs", "CLFRL", "Bookmarks", "CLFRK", "Common", "CLFRM", "Communities", "EJPVJ", "Files", "CLFRV", "Forums", "CLFRQ", "Homepage", "CLFRP", "Installer", "CLFRO", "Configuration", "CLFRR", "Notifications", "CLFNF", "Portlet", "CLFRT", "FedSearch", "CLFWX", "News", "CLFWY", "Event", "CLFWZ", "Widget", "CLFRN", "Profiles", "CLFWY", "User", "EJPIC", "Portal", "EJPVJ", "Wikis", "ADMS", "Websphere", "SECJ", "Security" ] } mutate { replace =\> ['timestamp', '%{wastimestamp} %{tz\_num}'] } date{ match =\> ["timestamp", "MM/dd/YY HH:mm:ss:SSS Z", "M/d/YY HH:mm:ss:SSS Z"] tag\_on\_failure =\> } mutate { remove\_field =\> ['tz', 'tz\_num', 'wastimestamp'] } } } output { elasticsearch { hosts =\> ["elasticsearch:9200"] } stdout { codec =\> rubydebug } } I have tried changing it to the following but that produces the same results. } date{ match =\> ["timestamp", "MM/dd/YY HH:mm:ss:SSS Z", "M/d/YY HH:mm:ss:SSS Z"] target =\> "@timestamp" tag\_on\_failure =\> } Here is an example from logstash { "was\_loglevel" =\> "I", "was\_msg" =\> " The trace state has changed. The new trace state is \*=info.", "message" =\> "[2/7/17 7:02:28:564 GMT] 000001b1 ManagerAdmin I TRAS0018I: The trace state has changed. The new trace state is \*=info.", "type" =\> "websphere", "was\_shortname" =\> "ManagerAdmin", "tags" =\> [ [0] "\_grokparsefailure" ], "was\_threadID" =\> "000001b1", "path" =\> "/opt/logs/SystemOut.log", "@timestamp" =\> 2017-02-09T07:59:23.656Z, "@version" =\> "1", "host" =\> "f2730df8227c", "was\_errcode" =\> "TRAS0018I", "timestamp" =\> "2/7/17 7:02:28:564 %{tz\_num}" } I'm pretty new to this so please would you mind explaining whilst I'm trying to learn the format of this file and what can be manipulated to what result? Thanks in advance ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 9, 2017, 8:15am UTC](https://discuss.elastic.co/t/timestamp-shows-indexed-date-time-and-not-time-from-log-entry/74472/2 "2017-02-09T08:15:12Z")
GMT is not included in your timezone translation table, hence you're getting "%{tz\_num}" in your `timestamp` field. Fixing that might be the only thing needed. From a very quick look the rest looks okay. ---
**Author:** ![hoagieben](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoagieben/32/15366_2.png) [@hoagieben](https://discuss.elastic.co/u/hoagieben)\ **Post date:** [February 9, 2017, 8:55am UTC](https://discuss.elastic.co/t/timestamp-shows-indexed-date-time-and-not-time-from-log-entry/74472/3 "2017-02-09T08:55:35Z")
Great minds! I added that after posting my message } translate { field =\> "tz" destination =\> "tz\_num" dictionary =\> [ "CET", "+0100", "CEST", "+0200", "EDT", "-0400", "GMT", "+0000" ] } In the output from logstash I see that tnz\_num has been removed and replaced with 0000 which looks better. Also, the @timestamp value matches! { "was\_loglevel" =\> "I", "was\_msg" =\> " The trace state has changed. The new trace state is \*=info.", "message" =\> "[2/7/17 7:02:28:564 GMT] 000001b1 ManagerAdmin I TRAS0018I: The trace state has changed. The new trace state is \*=info.", "type" =\> "websphere", "was\_shortname" =\> "ManagerAdmin", "tags" =\> [ [0] "\_grokparsefailure" ], "was\_threadID" =\> "000001b1", "path" =\> "/opt/logs/SystemOut.log", "@timestamp" =\> 2017-02-07T07:02:28.564Z, "@version" =\> "1", "host" =\> "f2730df8227c", "was\_errcode" =\> "TRAS0018I", "timestamp" =\> "2/7/17 7:02:28:564 +0000" } I deleted all the .sinceDB\_ files and then stopped logstash (in a Docker container) and started the container and that is when I see the matches with the date and time. In Kibana the values do not tally. I wonder if it is an index thing though I have specified sincedb\_path =\> "/dev/null" ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d84dadeb0adcad55de305db338165b4397b9ce46.jpg) Many thanks for the quick reply ---
**Author:** ![hoagieben](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoagieben/32/15366_2.png) [@hoagieben](https://discuss.elastic.co/u/hoagieben)\ **Post date:** [February 9, 2017, 8:57am UTC](https://discuss.elastic.co/t/timestamp-shows-indexed-date-time-and-not-time-from-log-entry/74472/4 "2017-02-09T08:57:26Z")
OK I may have found something to delete the Kibana index too [http://stackoverflow.com/questions/33820068/why-is-that-after-deleting-an-index-in-logstash-kibana-still-displays-it](http://stackoverflow.com/questions/33820068/why-is-that-after-deleting-an-index-in-logstash-kibana-still-displays-it) ---
**Author:** ![hoagieben](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoagieben/32/15366_2.png) [@hoagieben](https://discuss.elastic.co/u/hoagieben)\ **Post date:** [February 9, 2017, 9:37am UTC](https://discuss.elastic.co/t/timestamp-shows-indexed-date-time-and-not-time-from-log-entry/74472/5 "2017-02-09T09:37:21Z")
Now I've blown away the index and all data and restarted Kibana and Logstash I can create a new index and the dates and times look correct. curl -XDELETE [http://elasticsearch:9200/.kibana](http://elasticsearch:9200/.kibana) curl -XDELETE [http://elasticsearch:9200/\*](http://elasticsearch:9200/*) Thanks for your help ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 9, 2017, 9:37am UTC](https://discuss.elastic.co/t/timestamp-shows-indexed-date-time-and-not-time-from-log-entry/74472/6 "2017-03-09T09:37:37Z")
Closed on March 9, 2017, 9:37am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.