# Timestamp

**URL:** <https://discuss.elastic.co/t/timestamp/271206>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 25, 2021, 11:07pm UTC](https://discuss.elastic.co/t/timestamp/271206 "2021-04-25T23:07:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Akhil2](https://avatars.discourse-cdn.com/v4/letter/a/8797f3/32.png) [@Akhil2](https://discuss.elastic.co/u/Akhil2)\
**Post date:** [April 25, 2021, 11:07pm UTC](https://discuss.elastic.co/t/timestamp/271206/1 "2021-04-25T23:07:15Z")

</div>

Hello everyone,

I am trying to use timestamp from my log file instead of the timestamp when my logs were processed. in order to do that, I am using dissect processor and Timestamp processor together as below.

```auto
processors:
  - dissect:
      tokenizer: '%{}: %{DATE} %{DATE} %{}' 
      field: "message"
      target_prefix: ""
      
  - timestamp:
      field: DATE
      layouts:
        - '2021/03/08 11:12:44.749'
  - drop_fields:
      fields: [DATE]

```

so with dissect processor I am extracting Date from my logs and then with Timestamp processor I am trying to replace DATE with timestamp when logs were processed. but it is not working for some reason even though do not see any errors in filebeat logs but I see that these processors are being used.

```auto
2021-04-25T17:56:20.721-0400	DEBUG	[processors]	processors/processor.go:101	Generated new processors: dissect=%{}: %{DATE} %{DATE} %{},field=message,target_prefix=, timestamp=[field=DATE, target_field=@timestamp, timezone=UTC, layouts=[2021/03/08 11:12:44.749]], drop_fields={"Fields":["DATE"],"IgnoreMissing":false}

```

Following is my log format.

```auto
Trace: 2021/03/08 11:12:44.733 02 t=9CFE88 c=UNK key=P8 tag= (13007004)

```

I am stuck on this from sometime now. I am not sure what is wrong. can anyone please help me?

Thanks.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 26, 2021, 1:33am UTC](https://discuss.elastic.co/t/timestamp/271206/2 "2021-04-26T01:33:59Z")

</div>

One thing...  
Your layout is not correct read [this](https://www.elastic.co/guide/en/beats/filebeat/current/processor-translate-sid.html) carefully you need to use the reference time for the layout.

The layouts are described using a reference time that is based on this specific time: (i.e you must describe your format as this time)

Mon Jan 2 15:04:05 MST 2006

Since MST is GMT-0700, the reference time is:

01/02 03:04:05PM '06 -0700

To define your own layout, rewrite the reference time in a format that matches the timestamps you expect to parse. For more layout examples and details see the go lang

Something like this...but you will probably need `timezone` parameter otherwise it will be UTC.

`2006/01/02 15:04:05.000`

You can also use the `test` directive to check on startup.

---

<div class="post-metadata">

**Author:** ![Akhil2](https://avatars.discourse-cdn.com/v4/letter/a/8797f3/32.png) [@Akhil2](https://discuss.elastic.co/u/Akhil2)\
**Post date:** [April 26, 2021, 5:13pm UTC](https://discuss.elastic.co/t/timestamp/271206/3 "2021-04-26T17:13:21Z")

</div>

Thank you Stephen for the explanation! I will read the documentation carefully and hopefully it works! thanks again

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 24, 2021, 7:14pm UTC](https://discuss.elastic.co/t/timestamp/271206/4 "2021-05-24T19:14:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.