Parse log time into @timestamp with the Logstash date filter

The date filter parses a field and, by default, writes the result to @timestamp. This lets searches and time-based analysis use the event's reported time rather than the time it arrived at Logstash.

Extract and parse an HTTP date

filter {
  grok {
    match => { "message" => "%{HTTPDATE:log_time}" }
  }
  if [log_time] {
    date {
      match => ["log_time", "dd/MMM/yyyy:HH:mm:ss Z"]
      locale => "en"
      target => "@timestamp"
    }
  }
}

For 10/Oct/2000:13:55:36 +0000, the format includes day, English month abbreviation, year, time, and numeric UTC offset. Setting locale => "en" makes the month interpretation explicit.

Choose the format for your source

For a source that genuinely uses more than one format, list alternatives after the field name:

date {
  match => ["ts", "ISO8601", "yyyy-MM-dd HH:mm:ss"]
  timezone => "Asia/Shanghai"
}

Make a missing time zone explicit

Use timezone when the input has no offset or zone. Without it, the parser uses the platform's default time zone, which is not necessarily UTC. A timezone-free clock reading from Shanghai can therefore shift by eight hours when parsed on a UTC host.

@timestamp represents the resulting instant in UTC; a query interface may display that instant in another zone. Do not add eight hours manually to compensate for a display setting.

Keep failed parses visible

A failed date parse adds _dateparsefailure by default and leaves the existing @timestamp unchanged. That existing value is often the receipt time, but it may already have been supplied by an upstream producer or another filter. A missing extracted field in the guarded example is a separate extraction problem, usually accompanied by a grok failure tag.

Check these failures and sample events near day boundaries. Delays and retries make receipt time a poor substitute for event time, but parsing a source timestamp does not correct an inaccurate source clock or guarantee total event ordering.

References

• Elastic: filters date
• Elastic: filters grok