# Wrong timestamp suricata module

**URL:** <https://discuss.elastic.co/t/wrong-timestamp-suricata-module/250876>\
**Category:** Kibana\
**Created:** [October 3, 2020, 3:20pm UTC](https://discuss.elastic.co/t/wrong-timestamp-suricata-module/250876 "2020-10-03T15:20:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nunex\_17](https://avatars.discourse-cdn.com/v4/letter/n/f17d59/32.png) [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\
**Post date:** [October 3, 2020, 3:20pm UTC](https://discuss.elastic.co/t/wrong-timestamp-suricata-module/250876/1 "2020-10-03T15:20:30Z")

</div>

Hi. I+m having a problem with my suricata logs on kibana. My server and kibana are configured with the time Europe/Lisbon. The eve.json logs are in the correct timestamp. But when i move to kibana, the logs are shown in a different day with different hours. Like, today is 3/10/2020 and the logs are shown like 1/10/2020.

What am i doing wrong?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 3, 2020, 3:28pm UTC](https://discuss.elastic.co/t/wrong-timestamp-suricata-module/250876/2 "2020-10-03T15:28:59Z")

</div>

How are you ingesting the data? Using Logstash or Filebeat? Share your pipelines if possible.

Also, can you share an example of your `eve.json` log or at least the field with the timestamp?

---

<div class="post-metadata">

**Author:** ![nunex\_17](https://avatars.discourse-cdn.com/v4/letter/n/f17d59/32.png) [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\
**Post date:** [October 3, 2020, 3:47pm UTC](https://discuss.elastic.co/t/wrong-timestamp-suricata-module/250876/3 "2020-10-03T15:47:02Z")

</div>

I am using filebeat and suricata module directly to ES.

 ![Screenshot 2020-10-03 at 16.45.56](https://us1.discourse-cdn.com/elastic/original/3X/8/d/8d2fd8da8cc8791dfffa3e8ae68727af0fda780b.png) ![Screenshot 2020-10-03 at 16.46.01](https://us1.discourse-cdn.com/elastic/original/3X/f/1/f1c6f153c122b355c426b12c1babb01aec2c8c6d.png) ![Screenshot 2020-10-03 at 16.46.13](https://us1.discourse-cdn.com/elastic/original/3X/e/3/e330d2819b6e044b3ff72e86650c85b2376ced06.png) ![Screenshot 2020-10-03 at 16.46.21](https://us1.discourse-cdn.com/elastic/original/3X/3/9/3951a3b77d823d28fa8ca93ed86b167aacab87e0.png)

To see some data, i have to select 48h range

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 4, 2020, 4:34pm UTC](https://discuss.elastic.co/t/wrong-timestamp-suricata-module/250876/4 "2020-10-04T16:34:22Z")

</div>

Are the log in your discovery print and the one of the json the same? I can't see where the error could be.

Can you pick up a log where the date is showing up with different days in both discovery and the source json? Show in discovery all the date fields that your document have, not jus the one used by the kibana index pattern. Also, share the json document using the code feature `<\>`, it is better to read and to try to reproduce.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 1, 2020, 4:34pm UTC](https://discuss.elastic.co/t/wrong-timestamp-suricata-module/250876/5 "2020-11-01T16:34:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.