# Using @timestamp in a SQL Query

**URL:** <https://discuss.elastic.co/t/using-timestamp-in-a-sql-query/160471>\
**Category:** Kibana\
**Tags:** elastic-stack-sql\
**Created:** [December 12, 2018, 3:41am UTC](https://discuss.elastic.co/t/using-timestamp-in-a-sql-query/160471 "2018-12-12T03:41:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mickmill54](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mickmill54/32/38715_2.png) [@mickmill54](https://discuss.elastic.co/u/mickmill54)\
**Post date:** [December 12, 2018, 3:41am UTC](https://discuss.elastic.co/t/using-timestamp-in-a-sql-query/160471/1 "2018-12-12T03:41:49Z")

</div>

I am trying the following and can't figure it out.

POST \_xpack/sql?format=txt  
{  
"query":"select @timestamp, metricset.module, metricset.name FROM metricbeat"  
}

This does not work and returns below. Is there a trip using @timestamp in the column list? I tried CAST, and FORMAT, but no luck.

* * *

## Error

"error": {  
"root\_cause": [  
{  
"type": "parsing\_exception",  
"reason": "line 1:8: mismatched input '[' expecting {'(', 'ANALYZE', 'ANALYZED', 'CAST', 'CATALOGS', 'COLUMNS', 'CONVERT', 'DEBUG', 'EXECUTABLE', 'EXISTS', 'EXPLAIN', 'EXTRACT', 'FALSE', 'FORMAT', 'FUNCTIONS', 'GRAPHVIZ', 'LEFT', 'MAPPED', 'MATCH', 'NOT', 'NULL', 'OPTIMIZED', 'PARSED', 'PHYSICAL', 'PLAN', 'RIGHT', 'RLIKE', 'QUERY', 'SCHEMAS', 'SHOW', 'SYS', 'TABLES', 'TEXT', 'TRUE', 'TYPE', 'TYPES', 'VERIFY', '{FN', '{D', '{T', '{TS', '{GUID', '+', '-', '_', '?', STRING, INTEGER\_VALUE, DECIMAL\_VALUE, IDENTIFIER, DIGIT\_IDENTIFIER, QUOTED\_IDENTIFIER, BACKQUOTED\_IDENTIFIER}"  
}  
],  
"type": "parsing\_exception",  
"reason": "line 1:8: mismatched input '[' expecting {'(', 'ANALYZE', 'ANALYZED', 'CAST', 'CATALOGS', 'COLUMNS', 'CONVERT', 'DEBUG', 'EXECUTABLE', 'EXISTS', 'EXPLAIN', 'EXTRACT', 'FALSE', 'FORMAT', 'FUNCTIONS', 'GRAPHVIZ', 'LEFT', 'MAPPED', 'MATCH', 'NOT', 'NULL', 'OPTIMIZED', 'PARSED', 'PHYSICAL', 'PLAN', 'RIGHT', 'RLIKE', 'QUERY', 'SCHEMAS', 'SHOW', 'SYS', 'TABLES', 'TEXT', 'TRUE', 'TYPE', 'TYPES', 'VERIFY', '{FN', '{D', '{T', '{TS', '{GUID', '+', '-', '_', '?', STRING, INTEGER\_VALUE, DECIMAL\_VALUE, IDENTIFIER, DIGIT\_IDENTIFIER, QUOTED\_IDENTIFIER, BACKQUOTED\_IDENTIFIER}",  
"caused\_by": {  
"type": "input\_mismatch\_exception",  
"reason": null  
}  
},  
"status": 400  
}

---

<div class="post-metadata">

**Author:** ![Andrei\_Stefan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrei_stefan/32/47533_2.png) [@Andrei\_Stefan](https://discuss.elastic.co/u/Andrei_Stefan)\
**Post date:** [December 12, 2018, 8:17am UTC](https://discuss.elastic.co/t/using-timestamp-in-a-sql-query/160471/3 "2018-12-12T08:17:31Z")

</div>

@mickmill54 that's a strange error mentioning the square bracket. In any case, the correct command would be:

```auto
{
    "query":"select \"@timestamp\", metricset.module, metricset.name FROM metricbeat"
}

```

Curious on what version you tried this on?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 9, 2019, 8:17am UTC](https://discuss.elastic.co/t/using-timestamp-in-a-sql-query/160471/4 "2019-01-09T08:17:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.