ELK Stack Log timestamp - elastic-stack

Question

I'm relatively new to ELK stack in general and I'm trying to process some old logs back from 2014 for visualization. I was wondering if there's a way to allow Kibana to display the same time stamp as the creation of the logs instead of the time stamp when I added them into my forwarder client.
This is an excerpt from my filter section

Answer 1

The timestamp it's only show the time when logstash take the logs and saved to elasticsearch. Logstash can't know when that's logs had been created. The only possible way to know that , it's maybe if you saved the time inside the log's if they are systemlogs or your own logs with timestamps inside. Then you can create a filter in logstash and then just used as a key.
You can use grok filter for that.
http://grokconstructor.appspot.com/do/match
Example:
Output log
55.3.244.1 GET /index.html 15824 0.043
Filter
%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}
Logstash config
input {
file {
path => "/var/log/http.log"
}
}
filter {
grok {
match => { "message" => "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" }
}
}