# Unable to replace my log\_timestamp with @timestamp

**URL:** <https://discuss.elastic.co/t/unable-to-replace-my-log-timestamp-with-timestamp/264796>\
**Category:** Logstash\
**Created:** [February 19, 2021, 6:34am UTC](https://discuss.elastic.co/t/unable-to-replace-my-log-timestamp-with-timestamp/264796 "2021-02-19T06:34:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sanath\_ind](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@sanath\_ind](https://discuss.elastic.co/u/sanath_ind)\
**Post date:** [February 19, 2021, 6:34am UTC](https://discuss.elastic.co/t/unable-to-replace-my-log-timestamp-with-timestamp/264796/1 "2021-02-19T06:34:30Z")

</div>

Hi,

I am facing an issue while trying to set my log\_timestamp to @timestamp. I have tried many combinations from various date filter topics from here. But it is not giving me any positive result.

My original logstash.conf is different with various inputs. But for now I am trying to achieve this date filter combination so please find my basic date filter setup in the following logstash.conf

'input {  
file {  
start\_position =\> "beginning"  
path =\> [{{ division[division\_name].logstash.logstash\_conf\_connector\_logs }}]  
tags =\> ["processed\_records"]  
sincedb\_path =\> "/dev/null"  
}  
}

filter {  
if "processed\_records" in [tags]{  
grok {  
match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:log\_timestamp}"}  
}  
date {  
match =\> ["log\_timestamp", "YYYY-MM-dd HH:mm:ss,SSS"]  
timezone =\> "CET"  
}  
}  
}

output {  
if "processed\_records" in [tags]{  
if "\_grokparsefailure" not in [tags] {  
elasticsearch {  
hosts =\> ["[https://mylink:9200](https://mylink:9200)"]  
index =\> "ecs-ar-mld-%{+YYYY-MM-dd}"  
user =\> "ecs-ar"  
password =\> "{{ division[division\_name].logstash.logstash\_conf\_pwd }}"  
ssl =\> true  
cacert =\> "/usr/share/logstash/config/root-ca.pem"  
ilm\_enabled =\> false  
}  
}   
}

```
stdout {
	codec => rubydebug
}

```

}'

Please help me to replace my log\_timestamp with @timestamp field.

---

<div class="post-metadata">

**Author:** ![sanath\_ind](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@sanath\_ind](https://discuss.elastic.co/u/sanath_ind)\
**Post date:** [February 19, 2021, 8:34am UTC](https://discuss.elastic.co/t/unable-to-replace-my-log-timestamp-with-timestamp/264796/2 "2021-02-19T08:34:33Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/d/4/d473d3ca58af5fc9c325aea3407acc154f9e8b51.png)

---

<div class="post-metadata">

**Author:** ![sanath\_ind](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@sanath\_ind](https://discuss.elastic.co/u/sanath_ind)\
**Post date:** [February 19, 2021, 8:35am UTC](https://discuss.elastic.co/t/unable-to-replace-my-log-timestamp-with-timestamp/264796/3 "2021-02-19T08:35:10Z")

</div>

Please find my above logs onboarded.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 19, 2021, 6:19pm UTC](https://discuss.elastic.co/t/unable-to-replace-my-log-timestamp-with-timestamp/264796/4 "2021-02-19T18:19:11Z")

</div>

Clearly the date filter is working, it is just not using timezone CET, but instead Asia/Kabul! Is your local timezone +04:30? If so I would double check that you are running the configuration that you think you are.

---

<div class="post-metadata">

**Author:** ![sanath\_ind](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@sanath\_ind](https://discuss.elastic.co/u/sanath_ind)\
**Post date:** [February 20, 2021, 10:08am UTC](https://discuss.elastic.co/t/unable-to-replace-my-log-timestamp-with-timestamp/264796/5 "2021-02-20T10:08:07Z")

</div>

Hi Badger,

Thanks for replying. My timezone is Asia/kolkata (+5:30). But my logs timezone (server timezone) is CET. Thats why I have mentioned it as CET in the date filter. My understanding is the timezone value should be the actual logs generation timezone.

But actually it works after I change to Asia/kolkata.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2021, 10:08am UTC](https://discuss.elastic.co/t/unable-to-replace-my-log-timestamp-with-timestamp/264796/6 "2021-03-20T10:08:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.