# How to add timestamp to aggregate filter

**URL:** https://discuss.elastic.co/t/how-to-add-timestamp-to-aggregate-filter/205122
**Category:** Logstash
**Created:** [October 24, 2019, 5:30pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-to-aggregate-filter/205122 "2019-10-24T17:30:10Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![krishna\_bhargav](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krishna_bhargav/32/50877_2.png) [@krishna\_bhargav](https://discuss.elastic.co/u/krishna_bhargav)
#### Post date: [October 24, 2019, 5:30pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-to-aggregate-filter/205122/1 "2019-10-24T17:30:10Z")

</div>

filter contents below, timeevent should display current timestamp

aggregate {

```
		task_id => "%{ENVIRONMENT_ID}_%{SPN_FIRM_ID}_%{ENTITY_TYPE}_%{ENTITY_ID}"
		code => '
			map["keyInformation"] ||= {}
			map["keyInformation"]["environmentId"] = event.get("ENVIRONMENT_ID")
			map["keyInformation"]["entityId"] = event.get("ENTITY_ID")
			map["keyInformation"]["entityType"] = event.get("ENTITY_TYPE")
			map["keyInformation"]["firmId"] = event.get("SPN_FIRM_ID")
			
		
			map["associatedSleeves"] ||= [] 
			map["associatedSleeves"] << { 
			 "sleeveId" => event.get("SLV_ID") ,
			 "type" => event.get("SUB_MODEL_ID") ,
			 "nickname" => event.get("OWNER_ID") ,
			 "timeevent" => "%{@timestamp}" 
			}			
			event.cancel
		'
		push_map_as_event_on_timeout => true
		timeout => 2
    }

```

current output:

```
      "associatedSleeves" : [
        {
          "nickname" : "1",
          "type" : "1",
          "timeevent" : "%{@timestamp}",
          "sleeveId" : "146180"
        },
        {
          "nickname" : "2",
          "type" : "1",
          "timeevent" : "%{@timestamp}",
          "sleeveId" : "146181"
        }
      ],
      "keyInformation" : {
        "entityId" : "363147",
        "environmentId" : "QA_FDX",
        "firmId" : "101",
        "entityType" : "AC",
        "lastUpdated" : "2019-10-24T17:22:47.087Z"
      }
```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 24, 2019, 5:44pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-to-aggregate-filter/205122/2 "2019-10-24T17:44:24Z")

</div>

> [@krishna\_bhargav](#):
>
> "timeevent" =\> "%{@timestamp}"

Use event.get just as you did for the other fields.

---

<div class="post-metadata">

### Author: ![krishna\_bhargav](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krishna_bhargav/32/50877_2.png) [@krishna\_bhargav](https://discuss.elastic.co/u/krishna_bhargav)
#### Post date: [October 24, 2019, 6:02pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-to-aggregate-filter/205122/3 "2019-10-24T18:02:15Z")

</div>

@Badger Perfect it works ..Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 21, 2019, 6:02pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-to-aggregate-filter/205122/4 "2019-11-21T18:02:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
