# Last Seen timestamp under Hosts section appears to be incorrect

**URL:** <https://discuss.elastic.co/t/last-seen-timestamp-under-hosts-section-appears-to-be-incorrect/189769>\
**Category:** SIEM\
**Created:** [July 10, 2019, 12:40pm UTC](https://discuss.elastic.co/t/last-seen-timestamp-under-hosts-section-appears-to-be-incorrect/189769 "2019-07-10T12:40:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![redrise](https://avatars.discourse-cdn.com/v4/letter/r/858c86/32.png) [@redrise](https://discuss.elastic.co/u/redrise)\
**Post date:** [July 10, 2019, 12:40pm UTC](https://discuss.elastic.co/t/last-seen-timestamp-under-hosts-section-appears-to-be-incorrect/189769/1 "2019-07-10T12:40:44Z")

</div>

I've just been trying the new SIEM stuff out and i fired a load of data in from auditbeat, filebeat, and packetbeat on a CentOS 7 box.

When I looked at the Hosts section in the SIEM part of Kibana I noticed the value for the Last Seen field was set as a timestamp in the future (Nov 11, 2019 @ 03:43:02.000).

I tracked the timestamp and event down to an entry in an old rolled-over messages log (/var/log/messages-20181111) from November last year so it looks like the system module of filebeat thinks the message was actually from November this year!

Has anybody else seen this issue?

---

<div class="post-metadata">

**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\
**Post date:** [July 10, 2019, 3:42pm UTC](https://discuss.elastic.co/t/last-seen-timestamp-under-hosts-section-appears-to-be-incorrect/189769/2 "2019-07-10T15:42:52Z")

</div>

/var/log/messages doesn't contain the year in its log messages, so Filebeat can't really know that it's from 2018. You could ignore the whole file with the `ignore_older` [setting](https://www.elastic.co/guide/en/beats/filebeat/7.2/filebeat-input-log.html#filebeat-input-log-ignore-older) in Filebeat. Or you can manually change the year to 2018 while ingesting the data.

---

<div class="post-metadata">

**Author:** ![redrise](https://avatars.discourse-cdn.com/v4/letter/r/858c86/32.png) [@redrise](https://discuss.elastic.co/u/redrise)\
**Post date:** [July 11, 2019, 7:06am UTC](https://discuss.elastic.co/t/last-seen-timestamp-under-hosts-section-appears-to-be-incorrect/189769/3 "2019-07-11T07:06:31Z")

</div>

Thanks, I'll give the `ignore_older` setting a go 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2019, 7:06am UTC](https://discuss.elastic.co/t/last-seen-timestamp-under-hosts-section-appears-to-be-incorrect/189769/4 "2019-08-08T07:06:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.