# Is it possible to obtain a file creation date via Filebeat?

**URL:** https://discuss.elastic.co/t/is-it-possible-to-obtain-a-file-creation-date-via-filebeat/227124
**Category:** Beats
**Tags:** filebeat
**Created:** [April 8, 2020, 12:35pm UTC](https://discuss.elastic.co/t/is-it-possible-to-obtain-a-file-creation-date-via-filebeat/227124 "2020-04-08T12:35:54Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Guerreiro\_Sousa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guerreiro_sousa/32/46074_2.png) [@Guerreiro\_Sousa](https://discuss.elastic.co/u/Guerreiro_Sousa)
#### Post date: [April 8, 2020, 12:35pm UTC](https://discuss.elastic.co/t/is-it-possible-to-obtain-a-file-creation-date-via-filebeat/227124/1 "2020-04-08T12:35:54Z")

</div>

Is it possible to obtain a file creation date via Filebeat?

I would like to get this field to include as object of metadata in elastic.

---

<div class="post-metadata">

### Author: ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [April 10, 2020, 6:03pm UTC](https://discuss.elastic.co/t/is-it-possible-to-obtain-a-file-creation-date-via-filebeat/227124/2 "2020-04-10T18:03:18Z")

</div>

Hey @Guerreiro_Sousa, welcome to discuss 🙂

I think it is not possible to obtain this data with Filebeat, but maybe you can give a try to the `file_integrity` module of Auditbeat: [https://www.elastic.co/guide/en/beats/auditbeat/7.6/auditbeat-module-file\_integrity.html](https://www.elastic.co/guide/en/beats/auditbeat/7.6/auditbeat-module-file_integrity.html)  
It monitors changes on files, and it includes the creation time on the events. It can do a initial scan to collect the initial state of all the monitored files.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 8, 2020, 6:03pm UTC](https://discuss.elastic.co/t/is-it-possible-to-obtain-a-file-creation-date-via-filebeat/227124/3 "2020-05-08T18:03:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
