# @timestamp with \[13-Apr-2017 16:36:22 America/New\_York\]

**URL:** <https://discuss.elastic.co/t/timestamp-with-13-apr-2017-16-36-22-america-new-york/82441>\
**Category:** Logstash\
**Created:** [April 14, 2017, 6:58pm UTC](https://discuss.elastic.co/t/timestamp-with-13-apr-2017-16-36-22-america-new-york/82441 "2017-04-14T18:58:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mikemi](https://avatars.discourse-cdn.com/v4/letter/m/ec9cab/32.png) [@mikemi](https://discuss.elastic.co/u/mikemi)\
**Post date:** [April 14, 2017, 6:58pm UTC](https://discuss.elastic.co/t/timestamp-with-13-apr-2017-16-36-22-america-new-york/82441/1 "2017-04-14T18:58:57Z")

</div>

I have a PHP log I'm trying to get times from. Logstash is just setting `@timestamp` as the current time the log is parsed.

The log starts off with this:  
`[13-Apr-2017 16:36:22 America/New_York]`

The relevant part of my filter looks like this: (grok matches, I just abbreviated)

```
    grok {
      match => [
        "message", "\[%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME} %{DATA:tz}\] ..."
      ]
    }
    date {
      timezone => "%{tz}"
      locale => "en"
      match => ["timestamp", "dd-MMM-yyyy HH:mm:ss ZZZ"]
    }

```

The value of `@timestamp` when I run this is always the current date/time.

What changes do I need to make for this to work?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 18, 2017, 5:37am UTC](https://discuss.elastic.co/t/timestamp-with-13-apr-2017-16-36-22-america-new-york/82441/2 "2017-04-18T05:37:44Z")

</div>

You're not capturing the timestamp components into a `timestamp` field. Your grok expression should look like this

```
\[(?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) %{DATA:tz}\] ...

```

and you should remove " ZZZ" from your date pattern.

---

<div class="post-metadata">

**Author:** ![mikemi](https://avatars.discourse-cdn.com/v4/letter/m/ec9cab/32.png) [@mikemi](https://discuss.elastic.co/u/mikemi)\
**Post date:** [April 19, 2017, 3:22am UTC](https://discuss.elastic.co/t/timestamp-with-13-apr-2017-16-36-22-america-new-york/82441/3 "2017-04-19T03:22:41Z")

</div>

Finally, I understand how the timestamp is assigned. Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 17, 2017, 3:26am UTC](https://discuss.elastic.co/t/timestamp-with-13-apr-2017-16-36-22-america-new-york/82441/4 "2017-05-17T03:26:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.