# Timestamps reset to current day

**URL:** <https://discuss.elastic.co/t/timestamps-reset-to-current-day/71066>\
**Category:** Logstash\
**Created:** [January 10, 2017, 10:59am UTC](https://discuss.elastic.co/t/timestamps-reset-to-current-day/71066 "2017-01-10T10:59:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![poysama](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/poysama/32/14425_2.png) [@poysama](https://discuss.elastic.co/u/poysama)\
**Post date:** [January 10, 2017, 10:59am UTC](https://discuss.elastic.co/t/timestamps-reset-to-current-day/71066/1 "2017-01-10T10:59:59Z")

</div>

Disclaimer: ELK beginner

Hi. So I just upgraded my Logstash (2.x) to 5.1.1. Prior to this, I had VPN logs.

When I started logstash, my previous VPN logs had their timestamps changed. All entries now have the current date and it's not what I need to see on the graphs. I am supposed to have the VPN logins per day but now it shows all my logins happening today.

Now I had this grok right here before

```
  if [type] == "openvpn" {
    grok {
      match => { "message" => "%{WORD:timestamp_day} %{SYSLOGTIMESTAMP:openvpn_timestamp} %{NUMBER:timestamp_year} %{IP:openvpn_client}\:%{POSINT:openvpn_pid} %{GREEDYDATA:openvpn_message}" }
    }
  }

```

Luckily, I have recorded the 'original' timestamp when the log was made through 'openvpn\_timestamp'. I guess I would not be having a problem for future entries.

I am misunderstanding the @timestamp field. I thought it automatically converts to the time when the log was made, not when the log was pushed to logstash. Is this correct?

Also, Is there any way I can revert the entries back to their original timestamp?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 12, 2017, 5:51am UTC](https://discuss.elastic.co/t/timestamps-reset-to-current-day/71066/2 "2017-01-12T05:51:34Z")

</div>

> [@poysama](#):
>
> I am misunderstanding the @timestamp field. I thought it automatically converts to the time when the log was made, not when the log was pushed to logstash. Is this correct?

Only if you use a date filter 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2017, 5:51am UTC](https://discuss.elastic.co/t/timestamps-reset-to-current-day/71066/3 "2017-02-09T05:51:48Z")

</div>

Closed on February 9, 2017, 5:51am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.