# Using log's timestamp as @timestamp

**URL:** <https://discuss.elastic.co/t/using-logs-timestamp-as-timestamp/186629>\
**Category:** Logstash\
**Created:** [June 20, 2019, 9:16am UTC](https://discuss.elastic.co/t/using-logs-timestamp-as-timestamp/186629 "2019-06-20T09:16:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Artisan\_Ilustrado](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artisan_ilustrado/32/46158_2.png) [@Artisan\_Ilustrado](https://discuss.elastic.co/u/Artisan_Ilustrado)\
**Post date:** [June 20, 2019, 9:16am UTC](https://discuss.elastic.co/t/using-logs-timestamp-as-timestamp/186629/1 "2019-06-20T09:16:01Z")

</div>

I need to use my log's timestamp as @timestamp. I've tried different methods from the internet but none of them worked in my case

```auto
input {
	s3 {
		bucket => "*"
		access_key_id => "*"
		secret_access_key => "*"
		prefix => "*"
		backup_to_bucket => "*"
		backup_add_prefix => "*"
		region => "*"
		delete => *
	}
}

filter {
	grok {
		match => { "message" => "%{IPORHOST:clientip} \[%{TIMESTAMP_ISO8601:logtimestamp}\] %{WORD:protocol} %{GREEDYDATA:uri_path} \"%{WORD:verb} %{DATA:partial_request} HTTP/%{NUMBER:httpversion}\" \"%{GREEDYDATA:User_Agent}\" \"%{GREEDYDATA:request}\" %{NUMBER:response} %{NUMBER:ret1} %{NUMBER:ret2} "}
	}

date {
    match => ["logtimestamp", "ISO8601"]
    target => "@timestamp"
  }

mutate
	{
	     remove_field => ["message"]
	}
}
output {
	elasticsearch {
		hosts => ["endpoint:9200"]
		index => "mywebsite.com"
	}
	stdout {
		codec => rubydebug
	}
	
}

```

sample log entry:

```auto
46.229.168.134 [17/Jun/2019:08:00:19 +0000] https www.mywebsite.com "GET /somefolder/somefolder/request HTTP/1.1" "Mozilla/5.0 (compatible; someBot/3~bl; +http://www.somebot.com/bot.html)" "" 200 48260 8  

```

it doesn't show any errors but @timestamp is different from the log's timestamp even though I tried converting it to my browser's timezone which is how the kibana is configured.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 20, 2019, 11:52am UTC](https://discuss.elastic.co/t/using-logs-timestamp-as-timestamp/186629/2 "2019-06-20T11:52:21Z")

</div>

Your timestamp format does not match ISO8601. Try

```
grok { match => { "message" => '%{IPORHOST:clientip} \[%{HTTPDATE:logtimestamp}\] %{WORD:protocol} %{IPORHOST:servername} "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{QS:agent} %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{NUMBER}' } }
date { match => ["logtimestamp", "dd/MMM/YYYY:HH:mm:ss Z"] }
```

---

<div class="post-metadata">

**Author:** ![Artisan\_Ilustrado](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artisan_ilustrado/32/46158_2.png) [@Artisan\_Ilustrado](https://discuss.elastic.co/u/Artisan_Ilustrado)\
**Post date:** [June 24, 2019, 8:08am UTC](https://discuss.elastic.co/t/using-logs-timestamp-as-timestamp/186629/3 "2019-06-24T08:08:31Z")

</div>

Hi @Badger .  
Thank you for your response but I tried what you suggested and I received a \_dateparsefailure and this is my current config

```auto
filter {
        grok {
                match => { "message" => "%{IPORHOST:clientip} \[%{HTTPDATE:logtimestamp}\] %{WORD:protocol} %{GREEDYDATA:uri_path} \"%{WORD:verb} %{DATA:partial_request} HTTP/%{NUMBER:httpversion}\" \"%{GREEDYDATA:User_Agent}\" \"%{GREEDYDATA:request}\" %{NUMBER:response} %{NUMBER:ret1} %{NUMBER:ret2} "}
        }

date {
  match => ["logtimestamp", "dd/MMM/YYYY:HH:mm:ss z"]
  target => "@timestamp"
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 24, 2019, 12:00pm UTC](https://discuss.elastic.co/t/using-logs-timestamp-as-timestamp/186629/4 "2019-06-24T12:00:40Z")

</div>

> [@Artisan\_Ilustrado](#):
>
> I tried what you suggested

Not really. I suggested a date filter that matches against "dd/MMM/YYYY:HH:mm:ss Z" and that is not what you have used. The documentation explicitly says that z is not supported.

---

<div class="post-metadata">

**Author:** ![Artisan\_Ilustrado](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artisan_ilustrado/32/46158_2.png) [@Artisan\_Ilustrado](https://discuss.elastic.co/u/Artisan_Ilustrado)\
**Post date:** [June 25, 2019, 1:46am UTC](https://discuss.elastic.co/t/using-logs-timestamp-as-timestamp/186629/5 "2019-06-25T01:46:43Z")

</div>

It's working now! I just missed the casing of 'Z'  
Thank you so much @Badger

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2019, 1:46am UTC](https://discuss.elastic.co/t/using-logs-timestamp-as-timestamp/186629/6 "2019-07-23T01:46:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.