# Timestamp =\> @timestamp
**URL:** https://discuss.elastic.co/t/timestamp-timestamp/85763
**Category:** Logstash
**Created:** [May 15, 2017, 12:36pm UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763 "2017-05-15T12:36:24Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@Saplog](https://discuss.elastic.co/u/Saplog)
#### Post date: [May 15, 2017, 12:36pm UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/1 "2017-05-15T12:36:24Z")
Hi ,
I have specific log in a file log:
`Tue May 2 03:54:22 2017`
I use a grok filter to extract the timestamp into a field of its own called "datestamp"
`"datestamp" => "Tue May 2 03:57:00 2017 ", "@timestamp" => 2017-05-15T14:25:05.490Z,`
My filter here ,
`{filter { date { match => ["datestamp" , "yyyy-MM-dd'T'HH:mm:ss.SSSZ"] target => "@timestamp" } }`
i know how to replace the @timestamp by datestamp, but it doesn't work (dateparsefailure). I think it's my match , because the date format is not that , right ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 15, 2017, 12:39pm UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/2 "2017-05-15T12:39:11Z")
Correct. Your date pattern doesn't even resemble what your timestamp actually looks like. Note that the date filter logs what it's having trouble with.
---
### Author:  [@Saplog](https://discuss.elastic.co/u/Saplog)
#### Post date: [May 15, 2017, 1:07pm UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/4 "2017-05-15T13:07:43Z")
Okay thanks,
What date format can match here ?
Where can i find the date filter logs ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 15, 2017, 1:40pm UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/5 "2017-05-15T13:40:46Z")
> What date format can match here ?
The date filter documentation lists which tokens are available. "EEE MMM d HH:mm:ss YYYY" and "EEE MMM dd HH:mm:ss YYYY" should work in your case.
> Where can i find the date filter logs ?
In the Logstash log file, typically found in /var/log/logstash.
---
### Author:  [@Saplog](https://discuss.elastic.co/u/Saplog)
#### Post date: [May 15, 2017, 1:57pm UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/6 "2017-05-15T13:57:15Z")
It doesn't work ☹ , dateparsefailure again
Where can i find date filter logs for test file, because I test this file with logstash-f, so it doesn't write
in/ var/log/logstash...
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 15, 2017, 2:25pm UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/7 "2017-05-15T14:25:56Z")
> Where can i find date filter logs for test file, because I test this file with logstash-f, so it doesn't write
> in/ var/log/logstash...
In that case Logstash should dump the logs to stdout.
---
### Author:  [@Saplog](https://discuss.elastic.co/u/Saplog)
#### Post date: [May 15, 2017, 3:01pm UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/8 "2017-05-15T15:01:06Z")
> [@magnusbaeck](#):
>
> In that case Logstash should dump the logs to stdout.
It just said "\_dateparsefailure
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 15, 2017, 6:10pm UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/9 "2017-05-15T18:10:42Z")
I'm pretty sure it said a lot more than that. To save everyone's time, please copy/paste the command you're running and the full output you get.
---
### Author:  [@Saplog](https://discuss.elastic.co/u/Saplog)
#### Post date: [May 17, 2017, 6:54am UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/10 "2017-05-17T06:54:32Z")
So , my output test of run.conf file;
> `output { stdout { codec => rubydebug {} } } `
For test it, I run this
> `/usr/share/logstash/bin/logstash -f run.conf`
My date filter currently:
```
date {
match => ["datestamp" , "EEE MMM d HH:mm:ss YYYY"]
target => "@timestamp"
}
```
And my output ;
> {
> "path" =\> "/var/log/saprouterlog/saprouterlog.txt\_a\_20170502\_035422- 20170502\_072722",
> "datestamp" =\> "Tue May 2 03:59:22 2017 ",
> "@timestamp" =\> 2017-05-17T08:50:03.584Z,
> "@version" =\> "1",
> "host" =\> "elkf",
> "sap\_session" =\> "C106/-",
> "message" =\> "Tue May 2 03:59:22 2017 CONNECT FROM C106/- 172.16.58.19 9/22502",
> "type" =\> "saplog",
> "sap\_action" =\> "CONNECT FROM ",
> "sap\_ipsource" =\> "172.16.58.199",
> "tags" =\> [
> [0] "saprouter1",
> [1] "\_dateparsefailure",
> [2] "connect from"
> ],
> "sap\_port" =\> "/22502"
> }
> ^C10:50:04.721 [SIGINT handler] WARN logstash.runner - SIGINT received. Shuttin g down the agent.
> 10:50:04.795 [LogStash::Runner] WARN logstash.agent - stopping pipeline {:id=\>" main"}
> ^C10:50:04.889 [SIGINT handler] FATAL logstash.runner - SIGINT received. Termina ting immediately..
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 17, 2017, 7:12am UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/11 "2017-05-17T07:12:00Z")
It looks like you have a trailing space in the `datestamp` field, which is not accounted for in the pattern. Correct the pattern used to extract this field and I do not see why it would not work.
---
### Author:  [@Saplog](https://discuss.elastic.co/u/Saplog)
#### Post date: [May 17, 2017, 7:27am UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/12 "2017-05-17T07:27:27Z")
Thanks for your reply, but I try that with 1 more space between MMM and d and it didnt works.
> date {
> match =\> ["datestamp" , "EEE MMM d HH:mm:ss YYYY"]
> target =\> "@timestamp"
> }
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 17, 2017, 7:28am UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/13 "2017-05-17T07:28:55Z")
I am referring to the space at the end off the string.
---
### Author:  [@Saplog](https://discuss.elastic.co/u/Saplog)
#### Post date: [May 17, 2017, 7:38am UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/14 "2017-05-17T07:38:52Z")
Okay , it didnt work but it dont said me \_dateparsefailure
> {
> "path" =\> "/var/log/saprouterlog/saprouterlog.txt\_a\_20170510\_060630-20170510\_102448",
> "datestamp" =\> "Wed May 10 06:12:51 2017 ",
> "@timestamp" =\> 2017-05-10T04:12:51.000Z,
> "@version" =\> "1",
> "host" =\> "elkf",
> "sap\_session" =\> "C300/-",
> "message" =\> "Wed May 10 06:12:51 2017 CONNECT FROM C300/- 172.16.58.199/55352",
> "type" =\> "saplog",
> "sap\_action" =\> "CONNECT FROM ",
> "sap\_ipsource" =\> "172.16.58.199",
> "tags" =\> [
> [0] "saprouter1",
> [1] "connect from"
> ],
> "sap\_port" =\> "/55352"
My filter date after add the space:
> ```
> date {
> match => ["datestamp","EEE MMM d HH:mm:ss YYYY "]
> target => "@timestamp"
> }
>
> ```
>
> }
> }
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 17, 2017, 7:40am UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/15 "2017-05-17T07:40:28Z")
That seems to work. Remember that `@timestamp` is always in UTC. Instead of adding the space to the date filter pattern, I would recommend modifying the extraction pattern to get rid of it instead.
---
### Author:  [@Saplog](https://discuss.elastic.co/u/Saplog)
#### Post date: [May 17, 2017, 7:43am UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/16 "2017-05-17T07:43:12Z")
Ah yes , i forgot it 🙂
We can change UTC right ?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 17, 2017, 7:44am UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/17 "2017-05-17T07:44:55Z")
Timestamps in Elasticsearch are assumed to be in UTC, and a lot of functionality, including Kibana, relies on this. Trying to change this is therefore to ask for trouble.
---
### Author:  [@Saplog](https://discuss.elastic.co/u/Saplog)
#### Post date: [May 17, 2017, 7:45am UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/18 "2017-05-17T07:45:58Z")
Ok, Thank you very much for your help Christian and thanks magnus for your great help 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 14, 2017, 7:46am UTC](https://discuss.elastic.co/t/timestamp-timestamp/85763/19 "2017-06-14T07:46:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.