# Using my own time field instead of the @timestamp automatically added by Filebeat

**URL:** <https://discuss.elastic.co/t/using-my-own-time-field-instead-of-the-timestamp-automatically-added-by-filebeat/265709>\
**Category:** Logs\
**Created:** [February 28, 2021, 2:36am UTC](https://discuss.elastic.co/t/using-my-own-time-field-instead-of-the-timestamp-automatically-added-by-filebeat/265709 "2021-02-28T02:36:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![snowfrogdev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/snowfrogdev/32/84655_2.png) [@snowfrogdev](https://discuss.elastic.co/u/snowfrogdev)\
**Post date:** [February 28, 2021, 2:36am UTC](https://discuss.elastic.co/t/using-my-own-time-field-instead-of-the-timestamp-automatically-added-by-filebeat/265709/1 "2021-02-28T02:36:52Z")

</div>

I'm using the http\_endpoint input with Filebeat.

I wanna use the timestamp field from my JSON payload instead of the @timestamp that Filebeat seems to add automatically.

```auto
filebeat.inputs:
  - type: http_endpoint
    enabled: true
    listen_address: filebeat
    listen_port: 8088

output.elasticsearch:
  hosts: "${ELASTICSEARCH_HOSTS:elasticsearch:9200}"

setup.kibana:
  hosts: "kibana:5601"

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/0/60de69c557a9552a549e0421bd62b6aa56424941.png)

When I go to the index pattern section of the stack management section, I can see that my timestamp field is typed as a string and I can't select it as the official time field.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/1/91d49dbd7191b6862f594c32e674c66196f0aac2.png)

When I try to edit the type Date is not showing as an option in the list.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/3/43e80eb00bdbd9e85680b3b8a2219ed1243c37ca.png)

This ELK stack thing is going to be the death of me. 😀 It's a really cool suite of tools (yay for open source) but not exactly easy to configure. Thanks in advance for the help.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 28, 2021, 3:52am UTC](https://discuss.elastic.co/t/using-my-own-time-field-instead-of-the-timestamp-automatically-added-by-filebeat/265709/2 "2021-02-28T03:52:02Z")

</div>

There are a few basic areas you should understand like mappings (schema), data types etc normal data store concepts etc.

But tl;dr you can use [this](https://www.elastic.co/guide/en/beats/filebeat/current/processor-timestamp.html) to set the timestamp from the field in your message. (There are other ways as well but this is probably most direct)

Pay attention to [date](https://www.elastic.co/guide/en/elasticsearch/reference/7.11/date.html) formats, dates are an important concept in time series data.

Anything of value takes some investment. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2021, 3:52am UTC](https://discuss.elastic.co/t/using-my-own-time-field-instead-of-the-timestamp-automatically-added-by-filebeat/265709/3 "2021-03-28T03:52:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.