# Wrong timestamp in Kibana

**URL:** <https://discuss.elastic.co/t/wrong-timestamp-in-kibana/92897>\
**Category:** Logstash\
**Created:** [July 12, 2017, 11:35pm UTC](https://discuss.elastic.co/t/wrong-timestamp-in-kibana/92897 "2017-07-12T23:35:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_06](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@John\_06](https://discuss.elastic.co/u/John_06)\
**Post date:** [July 12, 2017, 11:35pm UTC](https://discuss.elastic.co/t/wrong-timestamp-in-kibana/92897/1 "2017-07-12T23:35:13Z")

</div>

I have the following configuration:

`Filebeat -> Kafka -> Logstash -> ES`

In logstash.conf I assign value of variable `logTimestamp` to `@timestamp`:

```
grok {
  match => {"message" => "(?<logTime>[0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3})"}
}
ruby {
  code => 'event.set("currentDate", Time.now.getlocal("-05:00").strftime("%Y.%m.%d"))'
}
ruby {
  code => 'event.set("logTimestamp", event.get("currentDate") + " " + event.get("logTime"))'
}
date {
  match => ["logTimestamp", "YYYY.MM.dd HH:mm:ss,SS"]
}

```

So the field values of `logTimestamp` and `@timestamp` should be the same. But in Kibana I can see they are different:  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/7/9/7975c3eaa0ec23d3a8a8cba71d6fd6b778ca88e4.png):

This is what Logstash logs show:

```
"logTimestamp" => "2017.07.12 00:59:24,578",
  "@timestamp" => 2017-07-12T22:06:22.463Z,

```

It's also unclear what timestamp value is assigned to `@timestamp`.  
Could anybody explain why that happened?

---

<div class="post-metadata">

**Author:** ![John\_06](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@John\_06](https://discuss.elastic.co/u/John_06)\
**Post date:** [July 13, 2017, 4:21am UTC](https://discuss.elastic.co/t/wrong-timestamp-in-kibana/92897/2 "2017-07-13T04:21:25Z")

</div>

Found the typo: extra `S` should be added to `match => ["logTimestamp", "YYYY.MM.dd HH:mm:ss,SS"]`

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [July 13, 2017, 8:42am UTC](https://discuss.elastic.co/t/wrong-timestamp-in-kibana/92897/3 "2017-07-13T08:42:23Z")

</div>

@timestamp -\> time when log write to ES ( localtime)  
logTimestamp -\> time of log, it's generated by program .... Sometime, logTimestamp is time in GMT.

i think that :). i hope it'll useful with you 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 10, 2017, 8:42am UTC](https://discuss.elastic.co/t/wrong-timestamp-in-kibana/92897/4 "2017-08-10T08:42:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.