# How to add timestamp before each event, timestamp is present at the beginning of the interval **URL:** \ **Category:** Logstash\ **Created:** [July 29, 2016, 7:25pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-before-each-event-timestamp-is-present-at-the-beginning-of-the-interval/56761 "2016-07-29T19:25:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Sri\_ram](https://avatars.discourse-cdn.com/v4/letter/s/3da27b/32.png) [@Sri\_ram](https://discuss.elastic.co/u/Sri_ram)\ **Post date:** [July 29, 2016, 7:25pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-before-each-event-timestamp-is-present-at-the-beginning-of-the-interval/56761/1 "2016-07-29T19:25:38Z")
Looking to parse vmstat data using Logstash. There will be a timestamp at the beginning of each interval, followed by metrics. Here, i need a timestamp value from vmstat data so that i can use it to overwrite the default Logstash timestamp (@timestamp). `Input data:` ``` Mon Apr 04 01:33:13 EDT 2016 r b swpd free buff cache si so bi bo in cs us sy id wa st 2 0 5172 174696 32256 231448 0 0 42 112 29 35 0 0 99 0 0 0 0 5172 174684 32256 231448 0 0 0 0 12 16 0 0 100 0 0 0 0 5172 174684 32256 231448 0 0 0 0 7 8 0 0 100 0 0 0 0 5172 174684 32256 231448 0 0 0 0 9 10 0 0 100 0 0 0 0 5172 174684 32256 231448 0 0 0 0 8 10 0 0 100 0 0 0 0 5172 174684 32256 231448 0 0 0 0 9 10 0 0 100 0 0 0 0 5172 174684 32256 231448 0 0 0 0 7 8 0 0 100 0 0 ``` Using grok filter, i was able to match the metrics but in the output i can see the timestamp value as Logstash started processing timestamp. I need the same timestamp for the subsequent events also. So, trying to solve this problem. **Expected output:** { "host" =\> "hostname", "timestamp": "Mon Apr 04 01:33:13 EDT 2016", "r" =\> 2, "b" =\> 0, "swpd" =\> 5172, "free" =\> 174696 ... } { "host" =\> "hostname", "timestamp": "Mon Apr 04 01:33:15 EDT 2016", "r" =\> 0, "b" =\> 0, "swpd" =\> 5172, "free" =\> 174684 ... } ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 31, 2016, 12:27am UTC](https://discuss.elastic.co/t/how-to-add-timestamp-before-each-event-timestamp-is-present-at-the-beginning-of-the-interval/56761/2 "2016-07-31T00:27:53Z")
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) is what you want. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 31, 2016, 2:57pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-before-each-event-timestamp-is-present-at-the-beginning-of-the-interval/56761/3 "2016-07-31T14:57:56Z")
I suggest you run `vmstat -t` to get the timestamp on each line, then use the date filter to parse it into the `@timestamp` field. ---
**Author:** ![Sri\_ram](https://avatars.discourse-cdn.com/v4/letter/s/3da27b/32.png) [@Sri\_ram](https://discuss.elastic.co/u/Sri_ram)\ **Post date:** [July 31, 2016, 7:24pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-before-each-event-timestamp-is-present-at-the-beginning-of-the-interval/56761/4 "2016-07-31T19:24:29Z")
Thank you for response. The vmstat log data is generated without time stamp for each line. This is the data, i am looking to parse using logstash. Is there any plugin/filter in Logstash to achieve it, or do i need to write custom plugin. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 31, 2016, 7:25pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-before-each-event-timestamp-is-present-at-the-beginning-of-the-interval/56761/5 "2016-07-31T19:25:28Z")
You might be able to use the aggregate filter. ---
**Author:** ![Sri\_ram](https://avatars.discourse-cdn.com/v4/letter/s/3da27b/32.png) [@Sri\_ram](https://discuss.elastic.co/u/Sri_ram)\ **Post date:** [August 1, 2016, 7:21pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-before-each-event-timestamp-is-present-at-the-beginning-of-the-interval/56761/6 "2016-08-01T19:21:14Z")
Not sure how aggregate filter will help me to solve this. I want to parse each event occurred in the interval time, it should contain the same time stamp as the time log data generated (here the 1st line is the time stamp). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:45am UTC](https://discuss.elastic.co/t/how-to-add-timestamp-before-each-event-timestamp-is-present-at-the-beginning-of-the-interval/56761/7 "2017-07-06T04:45:30Z")