# ES timestamp from logstash collectd codec **URL:** \ **Category:** Logstash\ **Created:** [May 5, 2017, 2:01pm UTC](https://discuss.elastic.co/t/es-timestamp-from-logstash-collectd-codec/84734 "2017-05-05T14:01:00Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mr\_chang7](https://avatars.discourse-cdn.com/v4/letter/m/cc9497/32.png) [@mr\_chang7](https://discuss.elastic.co/u/mr_chang7)\ **Post date:** [May 5, 2017, 2:01pm UTC](https://discuss.elastic.co/t/es-timestamp-from-logstash-collectd-codec/84734/1 "2017-05-05T14:01:00Z")
I'm following the link below to set up the collectd and logstash while storing the data in the ES. [https://www.elastic.co/guide/en/logstash/current/plugins-codecs-collectd.html](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-collectd.html) Just wondering what does the timestamp in ES represent? Is it time being loaded to ES? Can I use the time when the collectd collected or sent the data or something like that? Thanks. ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [May 5, 2017, 2:30pm UTC](https://discuss.elastic.co/t/es-timestamp-from-logstash-collectd-codec/84734/2 "2017-05-05T14:30:16Z")
The `@timestamp` field _is_ the [event timestamp from collectd](https://github.com/logstash-plugins/logstash-codec-collectd/blob/v3.0.3/lib/logstash/codecs/collectd.rb#L60). The codec does all of the translation for you. ---
**Author:** ![mr\_chang7](https://avatars.discourse-cdn.com/v4/letter/m/cc9497/32.png) [@mr\_chang7](https://discuss.elastic.co/u/mr_chang7)\ **Post date:** [May 5, 2017, 2:34pm UTC](https://discuss.elastic.co/t/es-timestamp-from-logstash-collectd-codec/84734/3 "2017-05-05T14:34:55Z")
That's great! And thanks for sharing the exact code for that. I asked this question as I use elastalert to query the events I found sometimes the elastalert responds with less hits than the count I can find from ES within the same query window. I came to know query\_delay option of the rule but wondering if there is any other option to take. Thinking how to to speed up the indexing time to ES. Thanks! ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [May 5, 2017, 3:00pm UTC](https://discuss.elastic.co/t/es-timestamp-from-logstash-collectd-codec/84734/4 "2017-05-05T15:00:12Z")
> [@mr\_chang7](#): > > I came to know query\_delay option of the rule but wondering if there is any other option to take. Thinking how to to speed up the indexing time to ES. That's a different question altogether. To preserve this thread as collectd-specific, I ask that you launch a new discussion, or find one of the many excellent ones on that topic. ---
**Author:** ![mr\_chang7](https://avatars.discourse-cdn.com/v4/letter/m/cc9497/32.png) [@mr\_chang7](https://discuss.elastic.co/u/mr_chang7)\ **Post date:** [May 5, 2017, 3:26pm UTC](https://discuss.elastic.co/t/es-timestamp-from-logstash-collectd-codec/84734/5 "2017-05-05T15:26:11Z")
Okay, appreciate your help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 2, 2017, 3:32pm UTC](https://discuss.elastic.co/t/es-timestamp-from-logstash-collectd-codec/84734/6 "2017-06-02T15:32:35Z")
Closed on June 2, 2017, 3:32pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.