# How to get access time of filename and set it in every log message?

**URL:** <https://discuss.elastic.co/t/how-to-get-access-time-of-filename-and-set-it-in-every-log-message/99378>\
**Category:** Beats\
**Created:** [September 5, 2017, 7:00am UTC](https://discuss.elastic.co/t/how-to-get-access-time-of-filename-and-set-it-in-every-log-message/99378 "2017-09-05T07:00:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![chros425](https://avatars.discourse-cdn.com/v4/letter/c/f6c823/32.png) [@chros425](https://discuss.elastic.co/u/chros425)\
**Post date:** [September 5, 2017, 7:00am UTC](https://discuss.elastic.co/t/how-to-get-access-time-of-filename-and-set-it-in-every-log-message/99378/1 "2017-09-05T07:00:39Z")

</div>

We need to sort message in Web, but the log messages are in different log files，so we want get the access time of log file ,then use the access time and offset to sort log message in different log files. How to it with filebeat? Thanks!

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [September 5, 2017, 10:06am UTC](https://discuss.elastic.co/t/how-to-get-access-time-of-filename-and-set-it-in-every-log-message/99378/2 "2017-09-05T10:06:56Z")

</div>

I don't think Filebeat has this functionality. We could add it as a processor, so feel free to open an issue in Github for it.

---

<div class="post-metadata">

**Author:** ![chros425](https://avatars.discourse-cdn.com/v4/letter/c/f6c823/32.png) [@chros425](https://discuss.elastic.co/u/chros425)\
**Post date:** [September 5, 2017, 11:12am UTC](https://discuss.elastic.co/t/how-to-get-access-time-of-filename-and-set-it-in-every-log-message/99378/3 "2017-09-05T11:12:40Z")

</div>

> [@tudor](#):
>
> We could add it as a processor

Thank you very much for replying me ! I have open an issue in Github for it. May I know when official could pay attention to this problem, I think the log sort is very common demand.

---

<div class="post-metadata">

**Author:** ![Leandro\_Sampaio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_sampaio/32/18409_2.png) [@Leandro\_Sampaio](https://discuss.elastic.co/u/Leandro_Sampaio)\
**Post date:** [September 5, 2017, 12:12pm UTC](https://discuss.elastic.co/t/how-to-get-access-time-of-filename-and-set-it-in-every-log-message/99378/4 "2017-09-05T12:12:47Z")

</div>

It's simple, you need put logstash to intercept a request from filebeat and edit the message

---

<div class="post-metadata">

**Author:** ![chros425](https://avatars.discourse-cdn.com/v4/letter/c/f6c823/32.png) [@chros425](https://discuss.elastic.co/u/chros425)\
**Post date:** [September 7, 2017, 3:28am UTC](https://discuss.elastic.co/t/how-to-get-access-time-of-filename-and-set-it-in-every-log-message/99378/5 "2017-09-07T03:28:06Z")

</div>

Thanks for replyinig me!  
This way you mentioned may not work, the sort information we need should be collected when the filebeat harvest log file, rather than send to logstash and then parse. There is no enough information that logstash can handle the sorting problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 26, 2017, 7:01am UTC](https://discuss.elastic.co/t/how-to-get-access-time-of-filename-and-set-it-in-every-log-message/99378/6 "2017-09-26T07:01:04Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.