# Add current timestamp to a logstash\_processed\_at field
**URL:** https://discuss.elastic.co/t/add-current-timestamp-to-a-logstash-processed-at-field/109745
**Category:** Logstash
**Created:** [November 30, 2017, 12:05pm UTC](https://discuss.elastic.co/t/add-current-timestamp-to-a-logstash-processed-at-field/109745 "2017-11-30T12:05:47Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Claude\_Sanderson](https://discuss.elastic.co/u/Claude_Sanderson)
#### Post date: [November 30, 2017, 12:05pm UTC](https://discuss.elastic.co/t/add-current-timestamp-to-a-logstash-processed-at-field/109745/1 "2017-11-30T12:05:48Z")
Currently there are a lot of FIlebeat instances in our infrastructure.
All of them are sending tons of logs to a single Logstash endpoint.
Some logs are not in json and come as a text. For example, Postfix logs.
Each log line has a syslog timestamp, which is parsed by grok pattern
and gets converted to a `timestamp` field on Logstash side.
That `timestamp` field gets converted to `@timestamp` by Logstash.
Quite often when there is a heavy load, Logstash queue becomes huge.
A lot of events have syslog timestamp which happened few minutes ago.
We would like to have DateTime.now() in `@timestamp` field.
Something like - `@timestamp` is the date when document appeared in ElasticSearch.
First idea was to change global grok pattern
```
SYSLOGBASE2 (?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:
```
and match syslog timestamp not into `timestamp` field, but to `syslog_timestamp`.
But it's to risky, because it can affect other projects.
Second idea was to add a date filter like
```
date {
add_field => { "logstash_processed_at" => "%{DATESTAMP}" }
}
```
But `DATESTAMP` is just a pattern and won't have current date.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 30, 2017, 12:15pm UTC](https://discuss.elastic.co/t/add-current-timestamp-to-a-logstash-processed-at-field/109745/2 "2017-11-30T12:15:16Z")
Just copy the initial `@timestamp` value to another field (before your date filter that overwrites `@timestamp`).
---
### Author:  [@Claude\_Sanderson](https://discuss.elastic.co/u/Claude_Sanderson)
#### Post date: [November 30, 2017, 12:29pm UTC](https://discuss.elastic.co/t/add-current-timestamp-to-a-logstash-processed-at-field/109745/3 "2017-11-30T12:29:12Z")
I thought that logs like
```
Nov 1 04:09:02 my-hostname postfix/cleanup[13509]: 3yRj7y3g8wz36b0: info: header X-MyHeader: 1585
```
are processed by Logstash automatically without extra configuration.
I think that Logstash uses some default grok patterns like `SYSLOGBASE2` to extract `timestamp` and replace `@timestamp` with extracted value. So, I don't have any custom date filters.
Idea number 3:
```
ruby {
code => "event.set('logstash_processed_at', Time.now());"
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 30, 2017, 12:51pm UTC](https://discuss.elastic.co/t/add-current-timestamp-to-a-logstash-processed-at-field/109745/4 "2017-11-30T12:51:55Z")
So what does your current configuration look like?
A ruby filter is of course also an option.
---
### Author:  [@Claude\_Sanderson](https://discuss.elastic.co/u/Claude_Sanderson)
#### Post date: [November 30, 2017, 12:54pm UTC](https://discuss.elastic.co/t/add-current-timestamp-to-a-logstash-processed-at-field/109745/5 "2017-11-30T12:54:41Z")
Something like this:
>
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 1, 2017, 6:47am UTC](https://discuss.elastic.co/t/add-current-timestamp-to-a-logstash-processed-at-field/109745/6 "2017-12-01T06:47:27Z")
Yes, but what inputs do you use? I'm asking because the syslog input has grok and date filters built into it so if that's what you use you'll never get a chance to save the original `@timestamp`.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 29, 2017, 6:47am UTC](https://discuss.elastic.co/t/add-current-timestamp-to-a-logstash-processed-at-field/109745/7 "2017-12-29T06:47:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.