# How can I add a basetime to timestamps?

**URL:** https://discuss.elastic.co/t/how-can-i-add-a-basetime-to-timestamps/129059
**Category:** Beats
**Tags:** filebeat
**Created:** [April 23, 2018, 8:44am UTC](https://discuss.elastic.co/t/how-can-i-add-a-basetime-to-timestamps/129059 "2018-04-23T08:44:00Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![joe\_bermejales](https://avatars.discourse-cdn.com/v4/letter/j/d26b3c/32.png) [@joe\_bermejales](https://discuss.elastic.co/u/joe_bermejales)
#### Post date: [April 23, 2018, 8:44am UTC](https://discuss.elastic.co/t/how-can-i-add-a-basetime-to-timestamps/129059/1 "2018-04-23T08:44:01Z")

</div>

Hi everyone,

we are new in Elastic framwork and we would like to monitor file logs from a robot control, with the following pattern. The problem is that timestamp are relative to a base time, so we would need to process the _base time + line timestamp_ to obtain the absolute timestamp.

It is possible to do this?

_Note: showed time are just example, we would need a milliseconds precission add_

**File log patter from Robot:**

```
Name: Test0003
Simulation Start: 2018/04/23 12:38:40

Time Data1 Data2
0.1 28,34 82,42
0.2 28,34 82,42
0.3 28,34 82,42
[...]

```

**What we need in elastic:**

```
Time Data1 Data2 Simulation
2018/04/23 12:38:41 28,34 82,42 Test0003
2018/04/23 12:38:42 28,34 82,42 Test0003
2018/04/23 12:38:43 28,34 82,42 Test0003
[...]

```

Describing the overall solution, we need to obtain logs from the robot and from other sources, but they must share the same time base (there will be a NTP v4. service to synchronize every source).

Is it possible to achieve this?

Thanks.

---

<div class="post-metadata">

### Author: ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [April 23, 2018, 4:17pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-basetime-to-timestamps/129059/2 "2018-04-23T16:17:21Z")

</div>

Hello @joe_bermejales,

This look more like a job for a custom plugin (or ruby filter) in Logstash, but you can still use filebeat to send the log to logstash and do the transformation there.

---

<div class="post-metadata">

### Author: ![joe\_bermejales](https://avatars.discourse-cdn.com/v4/letter/j/d26b3c/32.png) [@joe\_bermejales](https://discuss.elastic.co/u/joe_bermejales)
#### Post date: [April 27, 2018, 7:05am UTC](https://discuss.elastic.co/t/how-can-i-add-a-basetime-to-timestamps/129059/3 "2018-04-27T07:05:14Z")

</div>

> [@pierhugues](#):
>
> This look more like a job for a custom plugin (or ruby filter) in Logstash, but you can still use filebeat to send the log to logstash and do the transformation there.

Thanks for your response @pierhugues.

The control system will produce about 500 to 1000 log lines per second, and the total time could reach 5 minutes or more.

Can logstash or filebeat manage these 300.000 log lines? It is too much? Where can I find a performance rate or max. limit for the Elastic ecosystem?

Thanks in advance.

---

<div class="post-metadata">

### Author: ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [April 30, 2018, 1:17pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-basetime-to-timestamps/129059/4 "2018-04-30T13:17:38Z")

</div>

5 mins or more,maybe it would make sense to run a query on your ES cluster and populate the missing time?

> Can logstash or filebeat manage these 300.000 log lines? It is too much? Where can I find a performance rate or max. limit for the Elastic ecosystem?

That should not be a problem, you can scale your ES cluster or your Lostash instance horizontally if you need.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 28, 2018, 1:17pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-basetime-to-timestamps/129059/5 "2018-05-28T13:17:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
