# Assigning an aggregated event timestamp to @timestamp
**URL:** https://discuss.elastic.co/t/assigning-an-aggregated-event-timestamp-to-timestamp/229381
**Category:** Logstash
**Created:** [April 23, 2020, 5:44am UTC](https://discuss.elastic.co/t/assigning-an-aggregated-event-timestamp-to-timestamp/229381 "2020-04-23T05:44:44Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@xyz2](https://discuss.elastic.co/u/xyz2)
#### Post date: [April 23, 2020, 5:44am UTC](https://discuss.elastic.co/t/assigning-an-aggregated-event-timestamp-to-timestamp/229381/1 "2020-04-23T05:44:44Z")
HI,
I am aggragating events for each session from log
I fetch the log time from event
in aggregate filter, i want to have a field startdatetime and assign session open time to this,
set timeout\_timestamp\_field =\> "StartDateTime",
Then assign this "StartDateTime" to @timestamp
first part works fine but i get date parse error . What am i missing ?
Snippet from Filter plugin
mutate {
add\_field =\> {
"StartDateTime" =\> "%{log\_time}"
}
}
date {
match =\> ["log\_time" , "MMM dd HH:mm:ss"]
timezone =\> "EST5EDT"
target =\> "log\_time"
}
date {
match =\> ["StartDateTime" , "MMM dd HH:mm:ss"]
timezone =\> "EST5EDT"
target =\> "StartDateTime"
}
if ([msg] =~ /^session opened /) {
```
aggregate {
task_id => "%{sessionId}"
code => "
map['StartDateTime'] = event.get('log_time')
event.cancel()"
map_action => "create"
}
```
}
more aggregate filters
if ([msg] =~ /^session closed /) {
```
aggregate {
task_id => "%{sessionId}"
code => "
event.set('StartDateTime', map['StartDateTime'])"
map_action => "update"
end_of_task => true
timeout => 6
timeout_timestamp_field => "StartDateTime"
timeout_task_id_field => "sessionId"
push_map_as_event_on_timeout => true
}
```
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 23, 2020, 4:41pm UTC](https://discuss.elastic.co/t/assigning-an-aggregated-event-timestamp-to-timestamp/229381/2 "2020-04-23T16:41:02Z")
> [@xyz2](#):
>
> i get date parse error . What am i missing ?
Presumably the date format does not match the pattern you are using, but you have not shown us what your log\_time field looks like.
---
### Author:  [@xyz2](https://discuss.elastic.co/u/xyz2)
#### Post date: [April 23, 2020, 9:35pm UTC](https://discuss.elastic.co/t/assigning-an-aggregated-event-timestamp-to-timestamp/229381/3 "2020-04-23T21:35:37Z")
sample log\_time : Apr 9 15:15:11
log\_time and StartDateTime gets properly populated in the output
Output:
"StartDateTime" =\> 2020-04-09T19:14:46.000Z
"log\_time" =\> 2020-04-09T19:15:11.000Z
Sorry missed to add another filter which i added after all aggregate filters, that is giving me the error i guess
if[StartDateTime]
{
date {
match =\> ["StartDateTime" , "YYYY-MM-dd'T'HH:mm:ss.SSSZ", "MMM dd HH:mm:ss", "MMM d HH:mm:ss" , "ISO8601"]
timezone =\> "EST5EDT"
```
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 23, 2020, 10:15pm UTC](https://discuss.elastic.co/t/assigning-an-aggregated-event-timestamp-to-timestamp/229381/4 "2020-04-23T22:15:01Z")
> [@xyz2](#):
>
> Output:
> "StartDateTime" =\> 2020-04-09T19:14:46.000Z
> "log\_time" =\> 2020-04-09T19:15:11.000Z
If that is rubydebug output then both are already of type Logstash::Timestamp, which is what a date filter creates. A date filter cannot parse that.
---
### Author:  [@xyz2](https://discuss.elastic.co/u/xyz2)
#### Post date: [April 23, 2020, 10:57pm UTC](https://discuss.elastic.co/t/assigning-an-aggregated-event-timestamp-to-timestamp/229381/5 "2020-04-23T22:57:05Z")
how do i assign StartDateTime to @timestamp ?
I tried below in last aggregate filter and in timeout code, it sets the value of @timestamp as StartDateTime for normal events but gives aggregateException on timeout events and doesn't set @timestamp with the value of StartDateTime for timeout events
event.set('@timestamp', map['StartDateTime'])
timeout\_code =\> "
event.set('@timestamp', map['StartDateTime'])"
what is the right way to do so ?
---
### Author:  [@xyz2](https://discuss.elastic.co/u/xyz2)
#### Post date: [April 29, 2020, 9:57pm UTC](https://discuss.elastic.co/t/assigning-an-aggregated-event-timestamp-to-timestamp/229381/6 "2020-04-29T21:57:58Z")
Appreciate any help
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 27, 2020, 9:57pm UTC](https://discuss.elastic.co/t/assigning-an-aggregated-event-timestamp-to-timestamp/229381/7 "2020-05-27T21:57:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.