title: how to replace logstash @timestamp with log timestamp
body: <p>My time stamp in the logs are in the format as below</p>
  
  <pre><code>2016-04-07 18:11:38.169  which is  yyyy-MM-dd HH:mm:ss.SSS
  </code></pre>
  
  <p>This log file is not live one (stored/old one), and I am trying to replace this timpestamp with logstash @timestamp value for the betterment in the Kibana Visualization.</p>
  
  <p>My filter in logstash is like below</p>
  
  <pre><code>     grok {
         match =&gt; {
              "message" =&gt; [ "(?&lt;timestamp&gt;(\d){4}-(\d){2}-(\d){2} (\d){2}:(\d){2}:(\d){2}.(\d){3}) %{SYSLOG5424SD} ERROR u%{BASE16FLOAT}.%{JAVACLASS} - TransId:2b948ed5-12c0-4ae0-9b99-f1ee01191001 - TransactionId ::\"2b948ed5-12c0-4ae0-9b99-f1ee01191001\"- Actual Time taken to process \:\: %{NUMBER:responseTime:int}" ]
              } 
  
    }
  
  date {
          match =&gt; [ "timestamp:date" , "yyyy-MM-dd HH:mm:ss.SSS Z"  ]
          timezone =&gt; "UTC"
          target =&gt; "@timestamp" 
           } 
  </code></pre>
  
  <p>But, its not replacing the @timestamp value, Json value </p>
  
  <pre><code>{
    "_index": "logstash-2017.02.09",
    "_type": "logs",
    "_id": "AVoiZq2ITxwgj2avgkZa",
    "_score": null,
    "_source": {
      "path": "D:\\SoftsandTools\\Kibana\\Logs_ActualTimetakentoprocess.log",
      "@timestamp": "2017-02-09T10:23:58.778Z", **logstash @timestamp**
      "responseTime": 43,
      "@version": "1",
      "host": "4637",
      "message": "2016-04-07 18:07:01.809 [SimpleAsyncTaskExecutor-3] ERROR s.v.wsclient.RestClient - TransId:2b948ed5-12c0-4ae0-9b99-f1ee01191001 - TransactionId ::\"2b948ed5-12c0-4ae0-9b99-f1ee01191001\"- Actual Time taken to process :: 43",
      "timestamp": "2016-04-07 18:07:01.809"   **Mine time stamp**
    }
  </code></pre>
  
  <p>Sample log line -</p>
  
  <pre><code>2016-04-07 18:11:38.171 [SimpleAsyncTaskExecutor-1] ERROR s.v.wsclient.RestClient - TransId:2b948ed5-12c0-4ae0-9b99-f1ee01191001 - TransactionId ::"2b948ed5-12c0-4ae0-9b99-f1ee01191001"- Actual Time taken to process :: 521
  </code></pre>
  
  <p>Could you please help and let me know, where am I going wring here..</p>