# How to add a timestamp field with the indexing time in elasticsearch

**URL:** https://discuss.elastic.co/t/how-to-add-a-timestamp-field-with-the-indexing-time-in-elasticsearch/62723
**Category:** Elasticsearch
**Created:** [October 11, 2016, 2:32pm UTC](https://discuss.elastic.co/t/how-to-add-a-timestamp-field-with-the-indexing-time-in-elasticsearch/62723 "2016-10-11T14:32:16Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ericpietro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericpietro/32/9685_2.png) [@ericpietro](https://discuss.elastic.co/u/ericpietro)
#### Post date: [October 11, 2016, 2:32pm UTC](https://discuss.elastic.co/t/how-to-add-a-timestamp-field-with-the-indexing-time-in-elasticsearch/62723/1 "2016-10-11T14:32:16Z")

</div>

hi everybody,  
this is my problem:  
before 2.0.0 elasticsearch version, elasticsearch add a field called "\_timestamp" when indexing each log line..  
but now, it's deprecated. 😪  
my elasticsezarch version is : 2.3.3.  
how can I do the same thing ? Create a field called "indexing\_ts" and move the current indexing time in it ?  
I have the @timestamp field added by logstash (I call it : "parsing\_ts")  
but it is missing the moment when elasticsearch indexes (writes) the line log in my cluster.  
I need it to calculate the lag between parsing and indexing time ...  
Do u understand my demand ?  
ty very much

---

<div class="post-metadata">

### Author: ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)
#### Post date: [October 11, 2016, 3:09pm UTC](https://discuss.elastic.co/t/how-to-add-a-timestamp-field-with-the-indexing-time-in-elasticsearch/62723/2 "2016-10-11T15:09:37Z")

</div>

Hi,

there has been some discussion about this kind of question already in [this issue](https://github.com/elastic/elasticsearch/issues/15644). The overall suggestion there seems to be that the new Ingest node feature can be leveraged to add a field to the document when it enters the cluster. Also, there's some very [recent discussion](https://github.com/elastic/elasticsearch/issues/20859) of adding something like a `_last_modified` field with clearer semantics to take part of that load.

---

<div class="post-metadata">

### Author: ![ericpietro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericpietro/32/9685_2.png) [@ericpietro](https://discuss.elastic.co/u/ericpietro)
#### Post date: [October 12, 2016, 9:23am UTC](https://discuss.elastic.co/t/how-to-add-a-timestamp-field-with-the-indexing-time-in-elasticsearch/62723/3 "2016-10-12T09:23:18Z")

</div>

ty Christoph for your answer.  
unfortunately, it means that what i expect doesn't exist in elasticsearch v2.3.3...☹  
maybe a new field can be inserted in a future version (\_last\_modifed) ...  
as one guy wrote in the discussion you show me, why the "\_timestamp" has been deleted ? ☹

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 10:13pm UTC](https://discuss.elastic.co/t/how-to-add-a-timestamp-field-with-the-indexing-time-in-elasticsearch/62723/4 "2017-07-05T22:13:05Z")

</div>


