# Conditional for @timestamp
**URL:** https://discuss.elastic.co/t/conditional-for-timestamp/70351
**Category:** Logstash
**Created:** [January 2, 2017, 10:35am UTC](https://discuss.elastic.co/t/conditional-for-timestamp/70351 "2017-01-02T10:35:47Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@elvarb](https://discuss.elastic.co/u/elvarb)
#### Post date: [January 2, 2017, 10:35am UTC](https://discuss.elastic.co/t/conditional-for-timestamp/70351/1 "2017-01-02T10:35:47Z")
Is it possible to create a conditional for the @timestamp field, so for example if I get a message with a timestamp older than 1h then do something?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 2, 2017, 11:08am UTC](https://discuss.elastic.co/t/conditional-for-timestamp/70351/2 "2017-01-02T11:08:18Z")
It's possible, but Logstash's configuration language doesn't support date math so you'll have to do that in a ruby filter. The filter could set a tag that a standard conditional acts upon.
---
### Author:  [@elvarb](https://discuss.elastic.co/u/elvarb)
#### Post date: [January 2, 2017, 11:37am UTC](https://discuss.elastic.co/t/conditional-for-timestamp/70351/3 "2017-01-02T11:37:15Z")
Thats exactly what I did, the power of Ruby and the simplicity of Epoch timestamps is a wonderful thing
```
ruby {
code => "event['EventTimeDrift'] = (Time.now.to_f * 1000).to_i - event['EventTime'].to_i"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 30, 2017, 11:37am UTC](https://discuss.elastic.co/t/conditional-for-timestamp/70351/4 "2017-01-30T11:37:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.