# Timestamp from log line in nginx JSON logs via filebeat / beats

**URL:** <https://community.graylog.org/t/timestamp-from-log-line-in-nginx-json-logs-via-filebeat-beats/21809>\
**Category:** Graylog Tech Challenges\
**Created:** [November 20, 2021, 10:29am UTC](https://community.graylog.org/t/timestamp-from-log-line-in-nginx-json-logs-via-filebeat-beats/21809 "2021-11-20T10:29:05Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![ufth](https://avatars.discourse-cdn.com/v4/letter/u/aeb1de/32.png) [@ufth](https://community.graylog.org/u/ufth)\
**Post date:** [November 23, 2021, 1:17pm UTC](https://community.graylog.org/t/timestamp-from-log-line-in-nginx-json-logs-via-filebeat-beats/21809/3 "2021-11-23T13:17:02Z")

</div>

Thank you very much for this link, @gsmith ! For some reason I was not able to find it by myself, so these timestamp tag can be really convenient to use.

I was able to achieve my goal with this pipeline:

```auto
rule "parse timestamp"
when
    has_field("time_local")
then
    let new_time = parse_date(value: to_string($message.time_local), pattern:"dd/MMM/yyyy:HH:mm:ss Z");
    set_field("timestamp", new_time);
end

```

Note, that it is important to configure “Message Processors Configuration” so that “Pipeline Processor” works after “Message Filter Chain”. So we can parse JSON message and create fields, and then work with this fields in an easy way with pipelines.

 ![Message Processors Configuration](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/3c5bfb3b0748f658f0fd53c17398309228c0d43b.png)

 ![Configured extractors](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/9c555c9b6093e5cfcc0555691f4265a79520c299.png)

 ![correct timestamps](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/2d0d7ca34d63ddbdaf0008eeedf4fba7b0f7e481.png)

---

_[View the full topic](https://community.graylog.org/t/timestamp-from-log-line-in-nginx-json-logs-via-filebeat-beats/21809)._