How to add timestamp before each event, timestamp is present at the beginning of the interval

Looking to parse vmstat data using Logstash. There will be a timestamp at the beginning of each interval, followed by metrics. Here, i need a timestamp value from vmstat data so that i can use it to overwrite the default Logstash timestamp (@timestamp).

Input data:

 Mon   Apr 04 01:33:13 EDT 2016
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st           
 2  0   5172 174696  32256 231448    0    0    42   112   29   35  0  0 99  0  0 
 0  0   5172 174684  32256 231448    0    0     0     0   12   16  0  0 100  0  0 
 0  0   5172 174684  32256 231448    0    0     0     0    7    8  0  0 100  0  0 
 0  0   5172 174684  32256 231448    0    0     0     0    9   10  0  0 100  0  0 
 0  0   5172 174684  32256 231448    0    0     0     0    8   10  0  0 100  0  0 
 0  0   5172 174684  32256 231448    0    0     0     0    9   10  0  0 100  0  0 
 0  0   5172 174684  32256 231448    0    0     0     0    7    8  0  0 100  0  0 

Using grok filter, i was able to match the metrics but in the output i can see the timestamp value as Logstash started processing timestamp. I need the same timestamp for the subsequent events also. So, trying to solve this problem.

Expected output:
{
"host" => "hostname",
"timestamp": "Mon Apr 04 01:33:13 EDT 2016",
"r" => 2,
"b" => 0,
"swpd" => 5172,
"free" => 174696
...
}
{
"host" => "hostname",
"timestamp": "Mon Apr 04 01:33:15 EDT 2016",
"r" => 0,
"b" => 0,
"swpd" => 5172,
"free" => 174684
...
}

https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html is what you want.

I suggest you run vmstat -t to get the timestamp on each line, then use the date filter to parse it into the @timestamp field.

Thank you for response. The vmstat log data is generated without time stamp for each line. This is the data, i am looking to parse using logstash. Is there any plugin/filter in Logstash to achieve it, or do i need to write custom plugin.

You might be able to use the aggregate filter.

Not sure how aggregate filter will help me to solve this. I want to parse each event occurred in the interval time, it should contain the same time stamp as the time log data generated (here the 1st line is the time stamp).