# Timestamps do not match **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 9, 2016, 5:59pm UTC](https://discuss.elastic.co/t/timestamps-do-not-match/41305 "2016-02-09T17:59:57Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![romspacenut](https://avatars.discourse-cdn.com/v4/letter/r/96bed5/32.png) [@romspacenut](https://discuss.elastic.co/u/romspacenut)\ **Post date:** [February 9, 2016, 5:59pm UTC](https://discuss.elastic.co/t/timestamps-do-not-match/41305/1 "2016-02-09T17:59:57Z")
I've noticed that the @timestamp and the timestamp in the message do not match. I'm using Filebeats to push syslog to my ES cluster. Here's a screenshot of what I'm talking about. I'm currently using the index template what ships with Filebeat. How do I get the @timestamp and the timestamp from the syslog to match? ![](https://us1.discourse-cdn.com/elastic/original/2X/0/0a5faa9737c749e55da0dbd6f4fb6823fd51e7ff.gif) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [February 9, 2016, 6:24pm UTC](https://discuss.elastic.co/t/timestamps-do-not-match/41305/2 "2016-02-09T18:24:55Z")
`@timestamp` is the time that Filebeat read the line. Filebeat does not parse the lines it reads so I does not have any awareness that there is a timestamp in the line that it read. To parse the data out of the line you need to send the data to Logstash and configure Logstash to enrich the data sent to Elasticserach. The [Getting Started](https://www.elastic.co/guide/en/beats/libbeat/1.1/getting-started.html#logstash-installation) guide describes how to configure Filebeat to ship data to Logstash. Once the you have the data going to Logstash you can use a [grok filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) to make sense of the unstructured syslog lines and replace the `@timestamp` value or add a second timestamp field. ---
**Author:** ![romspacenut](https://avatars.discourse-cdn.com/v4/letter/r/96bed5/32.png) [@romspacenut](https://discuss.elastic.co/u/romspacenut)\ **Post date:** [February 9, 2016, 11:42pm UTC](https://discuss.elastic.co/t/timestamps-do-not-match/41305/3 "2016-02-09T23:42:56Z")
Thanks Andrew for your input. ---
**Author:** ![elk89](https://avatars.discourse-cdn.com/v4/letter/e/49beb7/32.png) [@elk89](https://discuss.elastic.co/u/elk89)\ **Post date:** [February 9, 2017, 4:52pm UTC](https://discuss.elastic.co/t/timestamps-do-not-match/41305/4 "2017-02-09T16:52:05Z")
Could you fix it? I have the same problem. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:49pm UTC](https://discuss.elastic.co/t/timestamps-do-not-match/41305/5 "2017-07-05T21:49:59Z")