# Log creation time is not matching with @timestamp value

**URL:** <https://forum.opensearch.org/t/log-creation-time-is-not-matching-with-timestamp-value/19042>\
**Category:** Community\
**Created:** [April 25, 2024, 9:33am UTC](https://forum.opensearch.org/t/log-creation-time-is-not-matching-with-timestamp-value/19042 "2024-04-25T09:33:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sandeep](https://avatars.discourse-cdn.com/v4/letter/s/ecccb3/32.png) [@Sandeep](https://forum.opensearch.org/u/Sandeep)\
**Post date:** [April 25, 2024, 9:33am UTC](https://forum.opensearch.org/t/log-creation-time-is-not-matching-with-timestamp-value/19042/1 "2024-04-25T09:33:44Z")

</div>

Hi,

I am trying to match the log event timestamp with OpenSearch @timestamp value. It has difference in minutes. My log format is as below -

```auto
xx.xx.xxx.xxx 10.48.11.36 - - [25/Apr/2024:09:08:16 +0000] "POST /api/x/x/9e309077033/poll HTTP/1.1" 200 12 "-" "python-requests/2.31.0"
- 127.0.0.1 - - [25/Apr/2024:09:08:55 +0000] "GET /api/x/x HTTP/1.1" 401 156 "-" "curl/7.88.1"

```

For the first log @timestamp value is: Apr 25, 2024 @ 09:08:59.815  
The second log @timestamp value is: Apr 25, 2024 @ 09:08:58.825

This is the config I am trying, but in output I always get the current timestamp rather than the value of event “timestamp”.

```auto
dissect {
        mapping => {
          "message" => '%{client_ip} %{+client_ip} %{?-} %{?-} [%{timestamp}] %{method} %{path} %{http_version} %{response} %{bytes} %{url} %{browser}'
        }
      }
      date {
        match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss ZZZ"]
        target => "@timestamp"
      }

```

Someone guide me to right direction.

Thanks

---

<div class="post-metadata">

**Author:** ![gaobinlong](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/gaobinlong/32/5242_2.png) [@gaobinlong](https://forum.opensearch.org/u/gaobinlong)\
**Post date:** [April 26, 2024, 1:18am UTC](https://forum.opensearch.org/t/log-creation-time-is-not-matching-with-timestamp-value/19042/2 "2024-04-26T01:18:40Z")

</div>

The date format you specified is not consistent with the format in the original log, the format should be `dd/MMM/yyyy:HH:mm:ss Z`