# Wrong timestamp from Windows filebeat
**URL:** https://discuss.elastic.co/t/wrong-timestamp-from-windows-filebeat/116892
**Category:** Logstash
**Created:** [January 24, 2018, 4:14pm UTC](https://discuss.elastic.co/t/wrong-timestamp-from-windows-filebeat/116892 "2018-01-24T16:14:28Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@uirobot](https://discuss.elastic.co/u/uirobot)
#### Post date: [January 24, 2018, 4:14pm UTC](https://discuss.elastic.co/t/wrong-timestamp-from-windows-filebeat/116892/1 "2018-01-24T16:14:29Z")
Hi!
I have a problem with timestamp in logstash. Timestamp in logs set to 01.01.2018, I don't know why.
Here is my config:
> input {
> beats {
> port =\> "5044"
> }
> }
> filter {
> grok {
> match =\> ["message", "%{TIME:eventtime}\t%{WORD:process\_id}\t%{WORD:currency}: GPU0 %{NUMBER:GPU0Speed:float} Mh/s"]
> match =\> ["message", "%{TIME:eventtime}\t%{WORD:process\_id}\tGPU0 t=%{NUMBER:GPU0Temp:float}C fan=%{NUMBER:GPU0Fan:int}%"]
> }
> date {
> match =\> ["eventtime", "HH:mm:ss:SSS"]
> }
> if "\_grokparsefailure" in [tags] {
> drop {}
> }
> }
> output {
> stdout { codec =\> rubydebug }
> elasticsearch {
> index =\> "gputest"
> hosts =\> "myhost"
> user =\> "elastic"
> password =\> "pass"
> }
> }
May be it happends because filebeat are on windows machine? I test the same on linux - it works fine. Also when I get data form windows filebeat, my eventtime didn't convert to time
Here is my output
> {
> "offset" =\> 1003414,
> "@version" =\> "1",
> "GPU0Temp" =\> 56.0,
> "GPU3Fan" =\> 81,
> "prospector" =\> {
> "type" =\> "log"
> },
> "beat" =\> {
> "name" =\> "DESKTOP-GPU9JEO",
> "hostname" =\> "DESKTOP-GPU9JEO",
> "version" =\> "6.1.2"
> },
> "GPU0Fan" =\> 81,
> "message" =\> "17:57:59:863\tfd0\tGPU0 t=56C fan=81%, GPU1 t=63C fan=80%, GPU2 t=52C fan=79%, GPU3 t=51C fan=81%",
> "GPU1Temp" =\> 63.0,
> "GPU2Fan" =\> 79,
> "host" =\> "DESKTOP-GPU9JEO",
> "GPU1Fan" =\> 80,
> "eventtime" =\> "17:57:59:863",
> "tags" =\> [
> [0] "beats\_input\_codec\_plain\_applied"
> ],
> "process\_id" =\> "fd0",
> "@timestamp" =\> 2018-01-01T17:57:59.863Z,
> "source" =\> "c:\Buron\miners\claymore10.1\1516610841\_log.txt",
> "GPU2Temp" =\> 52.0,
> "GPU3Temp" =\> 51.0
> }
---
### Author:  [@uirobot](https://discuss.elastic.co/u/uirobot)
#### Post date: [January 25, 2018, 7:38am UTC](https://discuss.elastic.co/t/wrong-timestamp-from-windows-filebeat/116892/2 "2018-01-25T07:38:16Z")
Right now, I found that event timestamp received form mac filebeat - wrong.
---
### Author:  [@uirobot](https://discuss.elastic.co/u/uirobot)
#### Post date: [January 25, 2018, 7:52am UTC](https://discuss.elastic.co/t/wrong-timestamp-from-windows-filebeat/116892/3 "2018-01-25T07:52:00Z")
Oh, I'm sorry, I found a problem. I thought that:
> date {
> match =\> ["eventtime", "HH:mm:ss:SSS"]
> }
...just convert from string to time, but it change time in timestamp with empty date.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 22, 2018, 7:52am UTC](https://discuss.elastic.co/t/wrong-timestamp-from-windows-filebeat/116892/4 "2018-02-22T07:52:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.