# Timestamp stdout is correct but to es is not

**URL:** https://discuss.elastic.co/t/timestamp-stdout-is-correct-but-to-es-is-not/105351
**Category:** Logstash
**Created:** [October 26, 2017, 7:12am UTC](https://discuss.elastic.co/t/timestamp-stdout-is-correct-but-to-es-is-not/105351 "2017-10-26T07:12:40Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![imqishi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/imqishi/32/23426_2.png) [@imqishi](https://discuss.elastic.co/u/imqishi)
#### Post date: [October 26, 2017, 7:12am UTC](https://discuss.elastic.co/t/timestamp-stdout-is-correct-but-to-es-is-not/105351/1 "2017-10-26T07:12:41Z")

</div>

I have a log file which is customized by myself, I want to use timestamp by my log and write config as following shows:

```
input {
file {
    path => "/var/log/testwrd.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
}
}
filter {
grok {
    match => {
        "message" => [
            "\[%{TIMESTAMP_ISO8601:time}\] API %{WORD:type} IP:\[%{IP:ip}\] MAC:\[%{MAC:mac}\] DEVICE:\[%{DATA:device_type}-%{DATA:device_sub_type}\] SERVER:\[%{IP:from_ip}\] \[%{WORD:action} \]",
            "\[%{TIMESTAMP_ISO8601:time}\] API %{WORD:type} IP:\[%{IP:ip}\] MAC:\[%{MAC:mac}\] DEVICE:\[%{DATA:device_type}-%{DATA:device_sub_type}\] SERVER:\[%{IP:from_ip}\] DEST:\[%{URI:dest}\] ERROR: \[%{DATA:error}\] INFO: \[%{DATA:info}\] RETURNCODE:\[%{NUMBER:rtn_code}\]",
            "\[%{TIMESTAMP_ISO8601:time}\] API %{WORD:type} IP:\[%{IP:ip}\] MAC:\[%{MAC:mac}\] DEVICE:\[%{DATA:device_type}-%{DATA:device_sub_type}\] SERVER:\[%{IP:from_ip}\] DEST:\[%{URI:dest}\] RETURNCODE:\[%{NUMBER:rtn_code}\]",
            "\[%{TIMESTAMP_ISO8601:time}\] API %{WORD:type} IP:\[%{IP:ip}\] MAC:\[%{MAC:mac}\] SERVER:\[%{IP:from_ip}\] DEST:\[%{URI:dest}\] RETURNCODE:\[%{NUMBER:rtn_code}\]",
            "\[%{TIMESTAMP_ISO8601:time}\] API %{WORD:type} IP:\[%{IP:ip}\] MAC:\[%{MAC:mac}\] SERVER:\[%{IP:from_ip}\] DEST:\[%{URI:dest}\] \[%{WORD:action} \]"
        ]
    }
}
if [action] != "FILTERED" {
    mutate {
        add_field => {
            "action" => "PUSH"
        }
    }
}
date {
    match => ["time", "yyyy-MM-dd HH:mm:ss"]
    target => "@timestamp"
}
mutate {
    remove_field => ["time"]
}
}
output {
    stdout { codec => rubydebug }
    #elasticsearch {
    # hosts => ["10.123.11.95:9200", "10.123.11.180:9200"]
    # index => "dhcp_notice-2017.10.23"
    #}
}

```

here is a example input:  
In console, it can be parsed correctly:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/e/aeea23b4e31d4b8abe95ded76e8ae9fee06192da.png)

but to elasticsearch, in kibana, I see:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e053bd9130cab0b15a43feaaab7e55d5284dfc5d.png)

why two different result? Thanks.

Well I thought maybe ISO8601 not compatible with my date format, so I changed it to DATA, but still no use...

---

<div class="post-metadata">

### Author: ![lueneburger](https://avatars.discourse-cdn.com/v4/letter/l/f475e1/32.png) [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [October 26, 2017, 7:35am UTC](https://discuss.elastic.co/t/timestamp-stdout-is-correct-but-to-es-is-not/105351/2 "2017-10-26T07:35:46Z")

</div>

Hi @imqishi,

did you try the grok debugger? there you can test if the pattern works for your timestamp also your grok pattern.

[Grok debugger](https://grokdebug.herokuapp.com/)

Also the event in logstash and the event in Kibana are not the same 😕

Cheers,  
Dirk

---

<div class="post-metadata">

### Author: ![imqishi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/imqishi/32/23426_2.png) [@imqishi](https://discuss.elastic.co/u/imqishi)
#### Post date: [October 26, 2017, 8:21am UTC](https://discuss.elastic.co/t/timestamp-stdout-is-correct-but-to-es-is-not/105351/3 "2017-10-26T08:21:52Z")

</div>

Oh...I lost a pattern for these logs so some logs timestamp became now ...really stupid....  
Thanks a lot!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 23, 2017, 8:22am UTC](https://discuss.elastic.co/t/timestamp-stdout-is-correct-but-to-es-is-not/105351/4 "2017-11-23T08:22:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.