title: Logstash Grok - How to parse @timestamp field using HTTPDERROR_DATE pattern?
body: <p>My log file has this pattern:</p>
  
  <pre><code>[Sun Oct 30 17:16:09 2016] [TRACE_HIGH] [TEST1] MessageTest1
  [Sun Oct 30 17:16:10 2016] [TRACE_HIGH] [TEST2] MessageTest2
  </code></pre>
  
  <p>Pattern:</p>
  
  <pre><code>\A\[%{HTTPDERROR_DATE}](?&lt;message&gt;(.|\r|\n)*)
  </code></pre>
  
  <p>Filter:</p>
  
  <pre><code>filter {
    if [type] == "mycustomlog" {
      grok {
        match =&gt; { "message" =&gt; "\A\[%{HTTPDERROR_DATE}](?&lt;message&gt;(.|\r|\n)*)"}
      }
      date {
        # Format: Wed Jan 13 11:50:44.327650 2016 (GROK: HTTPDERROR_DATE)
        match =&gt; [ "timestamp", "EEE MMM dd HH:mm:ss yyyy"]     
      }
      multiline {
        pattern =&gt; "^%{SYSLOG5424SD}%{SPACE}"
        what =&gt; "previous"
        negate=&gt; true
      }
    }
  } 
  </code></pre>
  
  <p><strong>I am trying to use my datetime log into @timestamp field, but I cannot parse this format into @timestamp. Why the date filter did not replace the @timestamp value?</strong></p>
  
  <p><strong>My @timestamp is different from the log row:</strong></p>
  
  <p>row[0]</p>
  
  <ul>
  <li>@timestamp: [Wed Nov 2 15:56:<strong>42</strong> 2016]  </li>
  <li>message: [Wed Nov 2 15:56:<strong>41</strong> 2016]</li>
  </ul>
  
  <p><a href="https://i.stack.imgur.com/Y5GJG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Y5GJG.png" alt="enter image description here"></a></p>
  
  <p>I am following this tutorial:</p>
  
  <p><a href="https://www.digitalocean.com/community/tutorials/adding-logstash-filters-to-improve-centralized-logging" rel="nofollow noreferrer">https://www.digitalocean.com/community/tutorials/adding-logstash-filters-to-improve-centralized-logging</a></p>
  
  <p>Using:</p>
  
  <p>Elasticsearch 2.2.x, Logstash 2.2.x, and Kibana 4.4.x</p>
  
  <p>Grok Constructor Print:
  <a href="https://i.stack.imgur.com/PlU98.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/PlU98.png" alt="enter image description here"></a></p>