# Logstash-output-opensearch not using my timestamp

**URL:** <https://forum.opensearch.org/t/logstash-output-opensearch-not-using-my-timestamp/16202>\
**Category:** OpenSearch\
**Created:** [October 9, 2023, 7:52pm UTC](https://forum.opensearch.org/t/logstash-output-opensearch-not-using-my-timestamp/16202 "2023-10-09T19:52:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![McJava1967](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@McJava1967](https://forum.opensearch.org/u/McJava1967)\
**Post date:** [October 9, 2023, 7:52pm UTC](https://forum.opensearch.org/t/logstash-output-opensearch-not-using-my-timestamp/16202/1 "2023-10-09T19:52:02Z")

</div>

Hi all. I’m using the **logstash-output-opensearch**. It’s working, but I can’t get it to use my log timestamp as @timestamp.

This is what I want it to use, direct from the log:  
`"ACTUAL_TIME": "2023-09-03T08:06:51.946Z"`

This is my logstash.conf filter:

```auto
filter{
  	date {
  		match => ["ACTUAL_TIME", "yyyy-MM-dd HH:mm:ss.SSSZ"]
  		remove_field => ["ACTUAL_TIME"]
	}
}

```

In discover, I see both fields, and they don’t match on the milliseconds:  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/0/082a7a287dd1ecc47afc1d0ab18707ac1ee1ee9e.png)

Any help would be, like, really helpful! 🙂

---

<div class="post-metadata">

**Author:** ![Gsmitt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/gsmitt/32/1718_2.png) [@Gsmitt](https://forum.opensearch.org/u/Gsmitt)\
**Post date:** [October 10, 2023, 4:58am UTC](https://forum.opensearch.org/t/logstash-output-opensearch-not-using-my-timestamp/16202/2 "2023-10-10T04:58:50Z")

</div>

Hey @McJava1967

Maybe somethign like this

```auto
filter {
  mutate { remove_field => ["field1", "field2", "field3", ... "fieldN"] }
}

```

```auto
filter {

  	 mutate { remove_field => ["ACTUAL_TIME"]  		
	}
   }

```

Is it posible to show your full Logstash config.

---

<div class="post-metadata">

**Author:** ![McJava1967](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@McJava1967](https://forum.opensearch.org/u/McJava1967)\
**Post date:** [October 10, 2023, 2:00pm UTC](https://forum.opensearch.org/t/logstash-output-opensearch-not-using-my-timestamp/16202/3 "2023-10-10T14:00:53Z")

</div>

Thank you for responding!

This is the full (anonymized) logstash.conf. Note “contextMap” now prepends ACTUAL TIME. The “\_app” above was to rename it. But still, it’s not working.

```auto
input {
   file {
     path => "/spring/logs/myApp/ELK/myLog.log"
   }
}
filter{
    json{
    	source => "message"
    }
  	date {
  		match => ["contextMap.ACTUAL_TIME", "yyyy-MM-dd HH:mm:ss.SSSZ"]
  		remove_field => ["contextMap.ACTUAL_TIME"]
	}
}output {
    opensearch {
        hosts => "http://myServer:9200"
        user => "XXXXX"
        password => "XXXXX"
        index => "my-app-%{[agent.version]}-%{+yyyy.MM.dd}"
        ssl_certificate_verification => false
    }
}

```

---

<div class="post-metadata">

**Author:** ![McJava1967](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@McJava1967](https://forum.opensearch.org/u/McJava1967)\
**Post date:** [October 10, 2023, 6:27pm UTC](https://forum.opensearch.org/t/logstash-output-opensearch-not-using-my-timestamp/16202/4 "2023-10-10T18:27:01Z")

</div>

OK. This issue seems to be with inner JSON. I told it to just remove “host”, and that works.

We are sending the Log4j2 MDC map, which generates a section like this:

```auto
	"contextMap": {
		"ACTUAL_TIME": "2023-09-03T08:06:51.946Z",

```

Does anyone know of a way to remove just ACTUAL\_TIME? I’ve tried all combinations I can think of.

Thanks!