# How to use the timestamp of the original logs in winlogbets?

**URL:** <https://discuss.elastic.co/t/how-to-use-the-timestamp-of-the-original-logs-in-winlogbets/209645>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [November 27, 2019, 9:43am UTC](https://discuss.elastic.co/t/how-to-use-the-timestamp-of-the-original-logs-in-winlogbets/209645 "2019-11-27T09:43:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\
**Post date:** [November 27, 2019, 9:43am UTC](https://discuss.elastic.co/t/how-to-use-the-timestamp-of-the-original-logs-in-winlogbets/209645/1 "2019-11-27T09:43:17Z")

</div>

I'm using winlogbeat to transfer data logs from event viewer. However, I have a problem with the timestamp. I'm not sure if it carry over the timestamp from the original log. Or is it overwriting during the indexing of data to elasticsearch.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [November 27, 2019, 10:04am UTC](https://discuss.elastic.co/t/how-to-use-the-timestamp-of-the-original-logs-in-winlogbets/209645/2 "2019-11-27T10:04:22Z")

</div>

I am not sure I understand your question. Let me know if this reply does not answer your question.

Winlogbeat preserves the timestamp of event logs from Windows and stores it under the field `@timestamp`. If you selected that field in ES as a timestamp, you should have no problem. Winlogbeat puts the time of creating an event internally (in Winlogbeat) in the field `event.created`. So you can have both read time and the timestamp of the event.

---

<div class="post-metadata">

**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\
**Post date:** [November 28, 2019, 3:42am UTC](https://discuss.elastic.co/t/how-to-use-the-timestamp-of-the-original-logs-in-winlogbets/209645/3 "2019-11-28T03:42:37Z")

</div>

Yes. You got my question right.  
I check my data and there are duplicates. The same timestamp. I assumed that maybe the timestamp is when the data indexed into ES.

Since you said that Winlogbeat preserves the timestamp of the event logs from Windows, I'll need to check another cause for data duplication.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2019, 3:55am UTC](https://discuss.elastic.co/t/how-to-use-the-timestamp-of-the-original-logs-in-winlogbets/209645/4 "2019-12-26T03:55:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.