# Give events without timestamp the timestamp from the last event

**URL:** https://discuss.elastic.co/t/give-events-without-timestamp-the-timestamp-from-the-last-event/131149
**Category:** Logstash
**Created:** [May 9, 2018, 9:39am UTC](https://discuss.elastic.co/t/give-events-without-timestamp-the-timestamp-from-the-last-event/131149 "2018-05-09T09:39:58Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 9, 2018, 2:46pm UTC](https://discuss.elastic.co/t/give-events-without-timestamp-the-timestamp-from-the-last-event/131149/2 "2018-05-09T14:46:02Z")

</div>

You could do it with aggregate using something like this.

```auto
  mutate { add_field => { "static" => "1" } }
  if [message] =~ /2015/ {
    aggregate {
      task_id => "%{static}"
      code => "map['something'] = event.get('message')"
    }
  } else {
    aggregate {
      task_id => "%{static}"
      code => "event.set('something', map['something'])"
    }
  }

```

Or you could do it using a ruby class variable. Use one of these in the first block and the other in the second.

```auto
    ruby { code => '@@t = event.get("timestamp")' }
    ruby { code => 'event.set("timestamp", @@t)' }

```

---

_[View the full topic](https://discuss.elastic.co/t/give-events-without-timestamp-the-timestamp-from-the-last-event/131149)._