# Add\_field =\> \[ "EventDate", "%{@timestamp}" \]

**URL:** https://discuss.elastic.co/t/add-field-eventdate-timestamp/33543
**Category:** Logstash
**Created:** [November 2, 2015, 4:31pm UTC](https://discuss.elastic.co/t/add-field-eventdate-timestamp/33543 "2015-11-02T16:31:02Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Erik\_Parienty](https://avatars.discourse-cdn.com/v4/letter/e/a587f6/32.png) [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)
#### Post date: [November 2, 2015, 4:31pm UTC](https://discuss.elastic.co/t/add-field-eventdate-timestamp/33543/1 "2015-11-02T16:31:02Z")

</div>

when i using **add\_field =\> ["EventDate", "%{@timestamp}"]**

i see this

{  
"@version" =\> "1",  
"@timestamp" =\> "2015-11-02T16:23:57.815Z",  
"type" =\> "blabla",  
**"EventDate" =\> "%{@timestamp}",**  
"Cluster" =\> "blabla",  
"host" =\> "blabla",  
"command" =\> "sudo /myscript"  
}

its only happens when using add\_field =\> ["EventDate", "%{@timestamp}"] in input exec on centos

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [November 2, 2015, 6:12pm UTC](https://discuss.elastic.co/t/add-field-eventdate-timestamp/33543/2 "2015-11-02T18:12:20Z")

</div>

> [@Erik\_Parienty](#):
>
> its only happens when using add\_field =\> ["EventDate", "%{@timestamp}"] in input exec

This is because there is no field `@timestamp` until _after_ the new event exits the input block. In other words, `@timestamp` is not a part of the event in the input block, so trying to add this field here will never work.

If you were to add a conditional and mutate filter, you can get the desired outcome:

```
filter {
  if [type] == "blablah" {
    mutate {
      add_field => { "EventDate" => "%{@timestamp}" }
    }
  }
}

```

Or something like it.

---

<div class="post-metadata">

### Author: ![Erik\_Parienty](https://avatars.discourse-cdn.com/v4/letter/e/a587f6/32.png) [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)
#### Post date: [November 3, 2015, 8:14am UTC](https://discuss.elastic.co/t/add-field-eventdate-timestamp/33543/3 "2015-11-03T08:14:44Z")

</div>

Thanks a lot 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:24am UTC](https://discuss.elastic.co/t/add-field-eventdate-timestamp/33543/4 "2017-07-06T05:24:22Z")

</div>


