# Keeping a value across events **URL:** \ **Category:** Elasticsearch\ **Created:** [December 15, 2014, 6:32pm UTC](https://discuss.elastic.co/t/keeping-a-value-across-events/21261 "2014-12-15T18:32:03Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Pierre\_Carlson](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@Pierre\_Carlson](https://discuss.elastic.co/u/Pierre_Carlson)\ **Post date:** [December 15, 2014, 6:32pm UTC](https://discuss.elastic.co/t/keeping-a-value-across-events/21261/1 "2014-12-15T18:32:03Z")
I have a log file that does not include a timestamp on each event. Rather a timestamp is generated and then one or more events are logged. I am trying to persist that timestamp and reuse it across the subsequent log messages. The logs look something like this: * * * Mon Dec 15 17:16:07 GMT 2014 0x11092BA23 waiting 0.049387334 seconds * * * Mon Dec 15 17:26:08 GMT 2014 0x11092BA33 waiting 0.000103615 seconds 0x11092BA59 waiting 0.000102342 seconds 0x11092BA50 waiting 0.000858821 seconds Any suggestions on storing that timestamp so that it can be applied on the subsequent messages? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/fa6866f2-5199-4067-ae33-f0e0c2db7fbe%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/fa6866f2-5199-4067-ae33-f0e0c2db7fbe%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Pierre\_Carlson](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@Pierre\_Carlson](https://discuss.elastic.co/u/Pierre_Carlson)\ **Post date:** [December 15, 2014, 9:18pm UTC](https://discuss.elastic.co/t/keeping-a-value-across-events/21261/2 "2014-12-15T21:18:57Z")
Totally forgot to mention that this is a LogStash question. On Monday, December 15, 2014 12:32:03 PM UTC-6, Pierre Carlson wrote: > I have a log file that does not include a timestamp on each event. Rather > a timestamp is generated and then one or more events are logged. I am > trying to persist that timestamp and reuse it across the subsequent log > messages. The logs look something like this: > > * * * > > Mon Dec 15 17:16:07 GMT 2014 > > 0x11092BA23 waiting 0.049387334 seconds > > * * * > > Mon Dec 15 17:26:08 GMT 2014 > > 0x11092BA33 waiting 0.000103615 seconds > > 0x11092BA59 waiting 0.000102342 seconds > > 0x11092BA50 waiting 0.000858821 seconds > > Any suggestions on storing that timestamp so that it can be applied on the > subsequent messages? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/6b739df8-b1c7-422f-84df-a6f301a4c25c%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/6b739df8-b1c7-422f-84df-a6f301a4c25c%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 16, 2014, 7:36am UTC](https://discuss.elastic.co/t/keeping-a-value-across-events/21261/3 "2014-12-16T07:36:18Z")
On Monday, December 15, 2014 at 22:18 CET, Pierre Carlson [mpcarl@gmail.com](mailto:mpcarl@gmail.com) wrote: > Totally forgot to mention that this is a LogStash question. Indeed, and as such [https://groups.google.com/forum/#!forum/logstash-users](https://groups.google.com/forum/#!forum/logstash-users) is a better fit. This topic has come up in the past so you may find relevant answers in the archives (the short answer is "no, you can't do this without a custom plugin"). -- Magnus Bäck | Software Engineer, Development Tools [magnus.back@sonymobile.com](mailto:magnus.back@sonymobile.com) | Sony Mobile Communications -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/20141216073617.GA9662%40seldlx20533.corpusers.net](https://groups.google.com/d/msgid/elasticsearch/20141216073617.GA9662%40seldlx20533.corpusers.net). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:43am UTC](https://discuss.elastic.co/t/keeping-a-value-across-events/21261/4 "2017-07-06T00:43:32Z")