# Having both filebeat and logstash event time in a log

**URL:** https://discuss.elastic.co/t/having-both-filebeat-and-logstash-event-time-in-a-log/368773
**Category:** Elasticsearch
**Created:** [October 14, 2024, 12:41pm UTC](https://discuss.elastic.co/t/having-both-filebeat-and-logstash-event-time-in-a-log/368773 "2024-10-14T12:41:50Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![jack\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_a/32/133082_2.png) [@jack\_a](https://discuss.elastic.co/u/jack_a)
#### Post date: [October 14, 2024, 12:41pm UTC](https://discuss.elastic.co/t/having-both-filebeat-and-logstash-event-time-in-a-log/368773/1 "2024-10-14T12:41:50Z")

</div>

Assume i do have a log in the following format:  
`[ISO8601_timestamp] [log_message]`  
what i want to do is to have 3 timestamp after i store my log in Elasticsearch. right now im reading logs with filebeat and then send them to logstash and then store it in elasticsearch.

```auto
filebeat ---> logstash ---> elasticsearch

```

i want when i store the documents in elasticsearch have 3 timestampe, namely:

```auto
filebeat_time
logstash_time
log_time

```

**filebeat\_ time** is when filebeat read the log. **logstash\_time** is when logstash received the log and **log\_time** is the ISO8601\_timestamp which already is in the file.

apparently filebeat itself adds a @tiemestam filed. also logstash itself adds a @timestamp filed too. althught i don't know what happen when logstash recieve a message that already has a @timestamp field. what crossed my mine was if there was a way that i could change the name of @timestamp field that filebeat adds to filebeat\_time using filebeat setting before message reaching logstash and then using logstash date plugin to store @timestamp automatically added by logstash in the field logstash\_time that way maybe i could solve my problem.  
the problem is i can't find a way using filebeat to create a filebeat\_time filed based on @timestamp and then delete @timestamp. i tried using processors

```auto
  - add_fields:
      target: ''
      fields:
        filebeat_time: '%{@timestamp}'

```

and

```auto
  - timestamp:
      field: @timestamp
      layouts:
        - '2006-01-02T15:04:05.999Z'
    target_field: filebeat_time

```

but they did not work. i could not find a way to create a filebeat\_time based on @timestamp field that filebeat already adds to a document.