# Security audit logs timestamp format **URL:** \ **Category:** Security\ **Created:** [October 12, 2022, 6:08pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199 "2022-10-12T18:08:54Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![infodata](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@infodata](https://forum.opensearch.org/u/infodata)\ **Post date:** [October 12, 2022, 6:08pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/1 "2022-10-12T18:08:54Z")
Hello my Opensearch 2.2 version security audit logs index patterns are not picking timestamp on looking at them from curl they are in this format “@timestamp”: “2022-10-12T06:22:41.076+00:00”, “\_index”: “security-auditlog-2022.10.12”, “\_id”: “vnzcyoMByBsiMUfwB2u1”, “\_score”: 1, “\_source”: { “audit\_cluster\_name”: “opensearch-cluster”, “audit\_node\_name”: “opensearch-node1”, “audit\_rest\_request\_method”: “POST”, “audit\_category”: “FAILED\_LOGIN”, ``` "@timestamp": "2022-10-12T06:22:41.076+00:00", "audit_request_effective_user_is_admin": false, ``` from other index which are ok have this below format “@timestamp”: “2022-10-12T16:24:00.108Z”, if timestamp field for default security audit logs needs to be changed ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [October 17, 2022, 2:01pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/2 "2022-10-17T14:01:50Z")
@infodata Could you elaborate more on this issue? What exactly are you try to achieve? ---
**Author:** ![infodata](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@infodata](https://forum.opensearch.org/u/infodata)\ **Post date:** [October 17, 2022, 2:31pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/3 "2022-10-17T14:31:47Z")
on dashboards only see hits but no data visible the data is there as I can see it from curl query from cli ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/2/290179d6cfd104124e92184a8a10d5797aada896.png) timestamp field is in \_source and it doesnt pick it up during create index ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/1/132d1da6d4f0c20c9d79e22b046c920def8eedbb.png) ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [October 18, 2022, 1:30pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/4 "2022-10-18T13:30:37Z")
@infodata Do you see the same behaviour with the admin user? ---
**Author:** ![infodata](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@infodata](https://forum.opensearch.org/u/infodata)\ **Post date:** [October 18, 2022, 1:33pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/5 "2022-10-18T13:33:32Z")
we have ad auth so admin UI login not allowed ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [October 18, 2022, 1:41pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/6 "2022-10-18T13:41:47Z")
@infodata Could you share the roles assigned to the user that you’ve used in the screenshots? ---
**Author:** ![infodata](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@infodata](https://forum.opensearch.org/u/infodata)\ **Post date:** [October 18, 2022, 1:50pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/7 "2022-10-18T13:50:43Z")
the curl query is with admin userid as it allows cli but not dashboard login UI user roles #### Roles (4) Roles you are currently mapped to by your administrator. adminuser own\_index kibana\_user all\_access * * * #### Backend roles (2) Backend roles you are currently mapped to by your administrator. admin kibanauser ---
**Author:** ![infodata](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@infodata](https://forum.opensearch.org/u/infodata)\ **Post date:** [October 26, 2022, 2:44pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/8 "2022-10-26T14:44:31Z")
anyone has this issue with ad enabled ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [October 27, 2022, 12:48pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/9 "2022-10-27T12:48:43Z")
@infodata I couldn’t repro your issue with basicauth and ldap. Have you made any changes to advanced settings in OpenSearch Dashboards? ---
**Author:** ![infodata](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@infodata](https://forum.opensearch.org/u/infodata)\ **Post date:** [October 27, 2022, 6:11pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/10 "2022-10-27T18:11:34Z")
the only change in advanced settings was enable dark mode on , turned it off and checked same issue ## Step 2 of 2: Configure settings Specify settings for your **security-auditlog** \* index pattern. The indices which match this index pattern don’t contain any time fields. ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [October 27, 2022, 6:40pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/11 "2022-10-27T18:40:04Z")
@infodata Do you run it as pod/container or service? ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [October 27, 2022, 6:58pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/12 "2022-10-27T18:58:31Z")
@infodata Could you check if there are any index templates configured? ```auto GET _index_template ``` Also, please share the result of the below command. ```auto GET security-auditlog-2022.10.12/_mapping ``` ---
**Author:** ![infodata](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@infodata](https://forum.opensearch.org/u/infodata)\ **Post date:** [October 28, 2022, 1:04am UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/13 "2022-10-28T01:04:35Z")
GET \_index\_template { “index\_templates” : } GET security-auditlog-2022.10.27/\_mapping { “security-auditlog-2022.10.27” : { “mappings” : { “properties” : { } } } } ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [October 28, 2022, 11:54am UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/14 "2022-10-28T11:54:59Z")
@infodata Do you see any permissions error when you execute that API? Either the index has no mappings assigned or your authenticated user has no permission to see it. That might explain why OpenSearch Dashboards doesn’t see the timestamp field. Please share your roles.yml and roles\_mapping.yml files. Is it a fresh deployment? ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [October 28, 2022, 3:31pm UTC](https://forum.opensearch.org/t/security-audit-logs-timestamp-format/11199/15 "2022-10-28T15:31:41Z")
@infodata Could you also share opensearch.yml, opensearch\_dashboards.yml, whitelist.yml and allowlist.yml?