Timestamps reset to current day

[poysama]

Disclaimer: ELK beginner

Hi. So I just upgraded my Logstash (2.x) to 5.1.1. Prior to this, I had VPN logs.

When I started logstash, my previous VPN logs had their timestamps changed. All entries now have the current date and it's not what I need to see on the graphs. I am supposed to have the VPN logins per day but now it shows all my logins happening today.

Now I had this grok right here before

  if [type] == "openvpn" {
    grok {
      match => { "message" => "%{WORD:timestamp_day} %{SYSLOGTIMESTAMP:openvpn_timestamp} %{NUMBER:timestamp_year} %{IP:openvpn_client}\:%{POSINT:openvpn_pid} %{GREEDYDATA:openvpn_message}" }
    }
  }

Luckily, I have recorded the 'original' timestamp when the log was made through 'openvpn_timestamp'. I guess I would not be having a problem for future entries.

I am misunderstanding the @timestamp field. I thought it automatically converts to the time when the log was made, not when the log was pushed to logstash. Is this correct?

Also, Is there any way I can revert the entries back to their original timestamp?

[warkolm (Mark Walkom)]

@poysama

I am misunderstanding the @timestamp field. I thought it automatically converts to the time when the log was made, not when the log was pushed to logstash. Is this correct?

Only if you use a date filter