# Timestamp want to store in index as date datatype **URL:** \ **Category:** Elasticsearch\ **Created:** [December 6, 2018, 4:49am UTC](https://discuss.elastic.co/t/timestamp-want-to-store-in-index-as-date-datatype/159653 "2018-12-06T04:49:44Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Sanchit\_Gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sanchit_gupta/32/38108_2.png) [@Sanchit\_Gupta](https://discuss.elastic.co/u/Sanchit_Gupta)\ **Post date:** [December 6, 2018, 4:49am UTC](https://discuss.elastic.co/t/timestamp-want-to-store-in-index-as-date-datatype/159653/1 "2018-12-06T04:49:44Z")
Hi Experts, i am using filebeat to read the soa logs and want msg\_timestamp value store in index as date datatype. Please help me how to create the index on msg\_timestamp. Below is my machine description: OS : Linux 7 ELK: 6.4 tools : elasticsearch, kibana, logstash, filebeat. Regards San ---
**Author:** ![bigphil](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bigphil](https://discuss.elastic.co/u/bigphil)\ **Post date:** [December 6, 2018, 5:05am UTC](https://discuss.elastic.co/t/timestamp-want-to-store-in-index-as-date-datatype/159653/2 "2018-12-06T05:05:43Z")
There are quite a few ways to accomplish this. It may just work right out of the box if you've parsed your date field cleanly. By default, Elasticsearch uses [dynamic field mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-field-mapping.html) with date detection enabled. If your date is in a format that is support by this function then it'll just work automatically. You can even customize this pattern if you have an index template already. You could also set the data type to date during Filebeat parsing using any number of methods. ---
**Author:** ![Sanchit\_Gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sanchit_gupta/32/38108_2.png) [@Sanchit\_Gupta](https://discuss.elastic.co/u/Sanchit_Gupta)\ **Post date:** [December 6, 2018, 5:11am UTC](https://discuss.elastic.co/t/timestamp-want-to-store-in-index-as-date-datatype/159653/3 "2018-12-06T05:11:49Z")
Hi Philip, thanks for the reply. Can you please tell me how to create index template and how to use in the code. I am just using the below code in logstash: input: ``` input { beats { port => 5044 ssl => true ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt" ssl_key => "/etc/pki/tls/private/logstash-forwarder.key" } } ``` filter: ``` filter { grok { match => ["message", "<%{DATA:log_timestamp}> <%{WORD:log_level}> <%{WORD:thread}> <%{HOSTNAME:hostname}> <%{HOSTNAME:servername}> <%{DATA:timer}> <<%{DATA:kernel}>> <> <%{DATA:uuid}> <%{NUMBER:timestamp}> <%{DATA:misc}> <%{DATA:log_number}> <%{DATA:log_message}>"] } } ``` output: ``` output { elasticsearch { hosts => ["xx.xxx.xx.xxx:9200"] sniffing => true manage_template => false index => "admin_%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } stdout { codec => rubydebug } } ``` ---
**Author:** ![bigphil](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bigphil](https://discuss.elastic.co/u/bigphil)\ **Post date:** [December 6, 2018, 5:17am UTC](https://discuss.elastic.co/t/timestamp-want-to-store-in-index-as-date-datatype/159653/4 "2018-12-06T05:17:29Z")
Well if you're using Logstash, simply use the [date filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) and it will do the work for you by putting whatever field you want to use as your timestamp in the special @timestamp field. ---
**Author:** ![Sanchit\_Gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sanchit_gupta/32/38108_2.png) [@Sanchit\_Gupta](https://discuss.elastic.co/u/Sanchit_Gupta)\ **Post date:** [December 6, 2018, 5:49am UTC](https://discuss.elastic.co/t/timestamp-want-to-store-in-index-as-date-datatype/159653/5 "2018-12-06T05:49:41Z")
i want apply the date filter and date filter in the template and create the index on date/error type. can you advice. do you have any example code? ---
**Author:** ![bigphil](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bigphil](https://discuss.elastic.co/u/bigphil)\ **Post date:** [December 6, 2018, 5:23pm UTC](https://discuss.elastic.co/t/timestamp-want-to-store-in-index-as-date-datatype/159653/6 "2018-12-06T17:23:42Z")
I'm not sure I understand your question. Can you elaborate? ---
**Author:** ![Sanchit\_Gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sanchit_gupta/32/38108_2.png) [@Sanchit\_Gupta](https://discuss.elastic.co/u/Sanchit_Gupta)\ **Post date:** [December 7, 2018, 4:57am UTC](https://discuss.elastic.co/t/timestamp-want-to-store-in-index-as-date-datatype/159653/7 "2018-12-07T04:57:52Z")
Hi Philip, First Thanks for your help!!! Flow of ELK : filebeat --\> logstash --\> Elasticsearch --\> Kibana. Actually what i tried to achieve is, i have soa logs in on one file named "AdminServer.log" (append mode). just on the based of date/error type(like update, shutdown, listener error, etc)/severity type i want to create the graph. my logstash conf file is below: input: ``` input { beats { port => 5044 ssl => true ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt" ssl_key => "/etc/pki/tls/private/logstash-forwarder.key" } } ``` filter: ``` filter { if [message] !~ /^####/ { drop { } } grok { match => { "message" => "\#\#\#\#\<%{DATA:msg_timestamp}\> \<%{DATA:msg_severity}\> \<%{DATA:msg_subsystem}\>%{GREEDYDATA:msg_details}" } } date { match => ["msg_timestamp", "MMMM Do YYYY, HH:mm:ss.SSS"] } } ``` output: ``` output { elasticsearch { hosts => ["xx.xxx.xx.xxx:9200"] sniffing => true manage_template => false index => "te_%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } stdout { codec => rubydebug } } ``` Please advise what i have to do sothat i can create graph based on date/error type/severity. Regards, San ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 4, 2019, 4:57am UTC](https://discuss.elastic.co/t/timestamp-want-to-store-in-index-as-date-datatype/159653/8 "2019-01-04T04:57:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.