# Wrong Timestamp

**URL:** <https://discuss.elastic.co/t/wrong-timestamp/44930>\
**Category:** Logstash\
**Created:** [March 20, 2016, 1:28pm UTC](https://discuss.elastic.co/t/wrong-timestamp/44930 "2016-03-20T13:28:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Libfy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/libfy/32/6929_2.png) [@Libfy](https://discuss.elastic.co/u/Libfy)\
**Post date:** [March 20, 2016, 1:28pm UTC](https://discuss.elastic.co/t/wrong-timestamp/44930/1 "2016-03-20T13:28:23Z")

</div>

Hi,

I have an issue with logstash.

all logs are prefixed with a wrong timestamp: the year is 2000.  
The rest of the date is good.

here is my output section from logstash.conf:

output {  
elasticsearch {  
template\_overwrite =\> "true"  
action =\> "index"  
hosts =\> "localhost"  
index =\> "logstash-%{+YYYYMMddHH00}"  
document\_type =\> "event"  
}  
stdout {}  
}

and here is a sample in /var/log/logstash/logstash.stdout

2000-03-20T13:22:20.000Z x.x.x.x true ;bla bla;bla bla bla;bla bla  
2000-03-20T13:22:20.000Z x.x.x.x true ;bla bla;bla bla bla;bla bla

it worked perfectly before.

Many thanks for your help.

Libfy

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 20, 2016, 2:35pm UTC](https://discuss.elastic.co/t/wrong-timestamp/44930/2 "2016-03-20T14:35:36Z")

</div>

What does the input and the rest of the sonfiguration look like?

---

<div class="post-metadata">

**Author:** ![Libfy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/libfy/32/6929_2.png) [@Libfy](https://discuss.elastic.co/u/Libfy)\
**Post date:** [March 20, 2016, 2:41pm UTC](https://discuss.elastic.co/t/wrong-timestamp/44930/3 "2016-03-20T14:41:01Z")

</div>

Hey,

thanks for your answer.

Here is the full conf file:

input {  
syslog {  
type =\> csv  
port =\> 5544  
}

}

filter {  
csv {  
separator =\> ";"  
columns =\> ["tag","src\_ip","ip\_status","Threat","HostDom","AS","ASNAme","Note\_VT","Last\_View","URL\_VT"]  
}

geoip {  
source =\> "src\_ip"  
target =\> "geoip"  
database =\> "/etc/logstash/GeoLiteCity.dat"  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float"]  
}

}

output {  
elasticsearch {  
template\_overwrite =\> "true"  
action =\> "index"  
hosts =\> "localhost"  
index =\> "logstash-%{+YYYYMMddHH00}"  
document\_type =\> "event"  
}  
stdout {}  
}

And here is the input from another server, though syslog:

true ;x.x.x.x;DOWN;XXXXX;XX;16276;XXXXXXXX;XXX;xxxx;XXXXX

---

<div class="post-metadata">

**Author:** ![Libfy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/libfy/32/6929_2.png) [@Libfy](https://discuss.elastic.co/u/Libfy)\
**Post date:** [March 20, 2016, 2:58pm UTC](https://discuss.elastic.co/t/wrong-timestamp/44930/4 "2016-03-20T14:58:59Z")

</div>

Hey,

I think I found the solution: just add locale =\> fr in the input section. And it works now.

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/wrong-timestamp/44930/5 "2017-07-06T05:06:13Z")

</div>