# Yet another @timestamp log file trouble... but it should be easy! **URL:** \ **Category:** Logstash\ **Created:** [May 12, 2015, 3:31pm UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561 "2015-05-12T15:31:50Z")\ **Posts on this page:** 15\ **Page:** 2
**Author:** ![alexolivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexolivan/32/57425_2.png) [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Post date:** [May 14, 2015, 3:18pm UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/21 "2015-05-14T15:18:19Z")
...aha... but... then, if I remove that "magic" timestamps do not match... I suspected this ruby filter stuff is a workaround, but, provide I remove it... how should I handle the 2 hours mismatch? Best regards! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 14, 2015, 3:44pm UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/22 "2015-05-14T15:44:21Z")
There is nothing to handle. There is no mismatch. @timestamp is UTC and your logs are UTC+2 and Logstash is doing the right thing. Kibana will automatically adjust all times to match the browser's timezone (but this will break if you "fix" @timestamp to be local time). ---
**Author:** ![alexolivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexolivan/32/57425_2.png) [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Post date:** [May 14, 2015, 3:52pm UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/23 "2015-05-14T15:52:52Z")
AHA... got it! now I understand why kibana has that "browser" correction feature!!! Many Thanks! ---
**Author:** ![elk\_2015](https://avatars.discourse-cdn.com/v4/letter/e/e19b73/32.png) [@elk\_2015](https://discuss.elastic.co/u/elk_2015)\ **Post date:** [June 22, 2015, 11:42am UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/24 "2015-06-22T11:42:34Z")
hi Alejandro Olivan, Can you please share the code snippet which increased @timestamp by 2:00. I need to increase the time by 4:00. Thanks ~ELKUser ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 22, 2015, 1:39pm UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/25 "2015-06-22T13:39:58Z")
> [@elk\_2015](#): > > Can you please share the code snippet which increased @timestamp by 2:00. > I need to increase the time by 4:00. What underlying problem are you trying to solve? As explained previously, `@timestamp` should be UTC and not local time, and if you're not getting UTC you should adjust things on the input end, i.e. typically the [date filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html). ---
**Author:** ![Rajeev\_Gaurav](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@Rajeev\_Gaurav](https://discuss.elastic.co/u/Rajeev_Gaurav)\ **Post date:** [December 29, 2015, 12:45pm UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/26 "2015-12-29T12:45:20Z")
> [@alexolivan](#): > > "YYYY-MM-dd HH:mm:ss" Hi , My logstash config file has filter as : date { match =\> ["RequestDate","MM/dd/yyyy: HH:mm:ss"] timezone =\> "UTC" } in My input file RequestDate is having value like :12/23/2015 3:32:00 AM ,12/25/2015 7:52:00 PM etc. I am getting error :←[33mFailed parsing date from field {:field=\>"RequestDate", :value=\>"12/25/2015 8:57", :exception=\>"Invalid format: "12/25/2015 8:57" is malformed at " 8:57 "", :config\_parsers=\>"MM/dd/yyyy: HH:mm:ss", :config\_locale=\>"default=en\_US", :l evel=\>:warn}←[0m Kindly help me asap. ---
**Author:** ![alexolivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexolivan/32/57425_2.png) [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Post date:** [December 29, 2015, 2:19pm UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/27 "2015-12-29T14:19:28Z")
Hi! Not sure what culd be hapening there.... at first sight I think that there is some difference (remember that in order to no error to raise, patterns has to match perfect! I have had bad times whith a timestamp that had double space character between date and time in the log file!!!): So... Maybe the problem comes because you are geting SINGLE digit hour in logfile plus AM/PM, while in your pattern you are declaring two digit hour fingerprint HH and no AM/PM) ... but this is only a guess... otherwise your pattern would be correct unlike there is some hidden space or something... Sad I cannot help you more! Best regards ---
**Author:** ![Rajeev\_Gaurav](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@Rajeev\_Gaurav](https://discuss.elastic.co/u/Rajeev_Gaurav)\ **Post date:** [December 29, 2015, 4:19pm UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/28 "2015-12-29T16:19:40Z")
First I am using csv file as an input file with code: input { file { path =\> ["C:\Users\rajgau\Documents\Software and Tools\ExcelData\ThreeFlight.csv"] } } And the Requested Date is :12/23/2015&3:32:00&AM Where & means space. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 2, 2016, 7:18pm UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/29 "2016-01-02T19:18:41Z")
There are at least three problems in the date pattern: - There a colon after "yyyy" which isn't present in the input strings. - You're using a 24-hour token for the hours ("HH") instead of a 12-hour token. - You don't have an AM/PM token at the end of the pattern. ---
**Author:** ![Rajeev\_Gaurav](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@Rajeev\_Gaurav](https://discuss.elastic.co/u/Rajeev_Gaurav)\ **Post date:** [January 4, 2016, 8:49am UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/30 "2016-01-04T08:49:35Z")
Thanks for replying magnusbaeck. I will like to post the error again: Error: ←[33mFailed parsing date from field {:field=\>"RequestDate", :value=\>"12/4/2015 1 1:54:42 PM", :exception=\>"Invalid format: "12/4/2015 11:54:42 PM" is malformed at ":42 PM"", :config\_parsers=\>"MM/dd/yyyy H:mm", :config\_locale=\>"default=en \_US", :level=\>:warn}←[0m For Example Request Date: 12/3/2015 2:52:18 AM so there is no colon on YYYY Can you suggest some pattern to parse the RequestDate. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 4, 2016, 9:02am UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/31 "2016-01-04T09:02:49Z")
> so there is no colon on YYYY No, not in the actual dates but according to your previous post there is a colon after the year in the date pattern: ``` date { match => ["RequestDate","MM/dd/yyyy: HH:mm:ss"] ``` ---
**Author:** ![specfinance](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/specfinance/32/7651_2.png) [@specfinance](https://discuss.elastic.co/u/specfinance)\ **Post date:** [April 21, 2016, 12:02pm UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/32 "2016-04-21T12:02:54Z")
Now, the problem, obviously comes as I try to get the @timestamp field with my log read values, instead of the default @tiemstamp values that include the capture time data. I have struggled with tons of combinations, leading to no success..[.](http://qwikfix.co.uk/rwe-npower-contact-number/) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 21, 2016, 12:56pm UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/33 "2016-04-21T12:56:31Z")
Please start a new thread for your problem, and include more details. What do your events look like, what do you want them to look like, and what's your configuration? ---
**Author:** ![gentitope](https://avatars.discourse-cdn.com/v4/letter/g/edb3f5/32.png) [@gentitope](https://discuss.elastic.co/u/gentitope)\ **Post date:** [September 19, 2016, 10:36pm UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/34 "2016-09-19T22:36:22Z")
Hello, I have this error, {:timestamp=\>"2016-09-14T16:43:48.937000+0100", :message=\>"Failed parsing date from field", :field=\>"timestamp", :value=\>"2016-09-14 15:43:48.258000", :exception=\>"Invalid format: "2016-09-14 15:43:48.258000"", :config\_parsers=\>"ISO8601,yyyy-MM-dd'T'HH:mm:ss.SSSZZ,yyyy-MM-dd HH:mm:ss,SSS,MMM dd YYYY HH:mm:ss", :config\_locale=\>"default=en\_US", :level=\>:warn} my filter config" grok { add\_tag =\> ["valid"] match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:log\_timestamp} %{DATA} Processed (?:inbound|outbound) message for ([^\s]+): %{GREEDYDATA:json\_data}" } } ``` json { source => json_data } date { match => ["timestamp","ISO8601","yyyy-MM-dd'T'HH:mm:ss.SSSZZ","yyyy-MM-dd HH:mm:ss,SSS","MMM dd YYYY HH:mm:ss"] remove_field => ["timestamp"] target => "@timestamp" ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:37am UTC](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561/35 "2017-07-06T04:37:55Z")
Closed on July 6, 2017, 4:37am UTC [Previous page](https://discuss.elastic.co/t/yet-another-timestamp-log-file-trouble-but-it-should-be-easy/561.md?page=1)