# Overriding filebeat palo alto modules @timestamp
**URL:** https://discuss.elastic.co/t/overriding-filebeat-palo-alto-modules-timestamp/289436
**Category:** Beats
**Tags:** filebeat
**Created:** [November 17, 2021, 11:27am UTC](https://discuss.elastic.co/t/overriding-filebeat-palo-alto-modules-timestamp/289436 "2021-11-17T11:27:38Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Sirrah](https://discuss.elastic.co/u/Sirrah)
#### Post date: [November 17, 2021, 11:27am UTC](https://discuss.elastic.co/t/overriding-filebeat-palo-alto-modules-timestamp/289436/1 "2021-11-17T11:27:38Z")
Recently, I set up a filebeat to receive palo alto and sophos data. Filebeat module parsed the data as the timestamp.
Instead of using the timestamp in log, i want to use the received time as @timestamp.
Does there any way to override the @timestamp parsed by filebeat module using receive time.
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [November 17, 2021, 1:04pm UTC](https://discuss.elastic.co/t/overriding-filebeat-palo-alto-modules-timestamp/289436/2 "2021-11-17T13:04:52Z")
You'll have to update the ingest pipelines.
---
### Author:  [@Sirrah](https://discuss.elastic.co/u/Sirrah)
#### Post date: [November 17, 2021, 1:16pm UTC](https://discuss.elastic.co/t/overriding-filebeat-palo-alto-modules-timestamp/289436/3 "2021-11-17T13:16:06Z")
I understand that we can override @timstamp using "target field:@timestamp" with a specific time fields.
However, how can I get the server current time or the log received time to override the @timestamp
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [November 17, 2021, 1:27pm UTC](https://discuss.elastic.co/t/overriding-filebeat-palo-alto-modules-timestamp/289436/4 "2021-11-17T13:27:59Z")
U can use `_ingest.timestamp` for the time it gets into Elasticsearch. Is there a reason u want to do this? The`@timestamp` fields is meant for when the event took place regardless of when it got to Elasticsearch.
---
### Author:  [@Sirrah](https://discuss.elastic.co/u/Sirrah)
#### Post date: [November 18, 2021, 1:53am UTC](https://discuss.elastic.co/t/overriding-filebeat-palo-alto-modules-timestamp/289436/5 "2021-11-18T01:53:30Z")
As Palo Alto Log do not show the timezone of it.
Therefore, I planned to standardize the timestamp to storage time.
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [November 18, 2021, 3:20am UTC](https://discuss.elastic.co/t/overriding-filebeat-palo-alto-modules-timestamp/289436/6 "2021-11-18T03:20:56Z")
Are u sending multiple Palo alto logs to the same filebeat instance and are they in different time zones? If so, one thing u could do is start multiple instances of the module and set a field with the respective timezone or add script processor to filebeat to set the timezone based off of log source IP... There are a bunch of things u could do. I personally wouldn't use the ingest time as ur source of truth for event timestamps as it could be widely inaccurate.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 16, 2021, 5:21am UTC](https://discuss.elastic.co/t/overriding-filebeat-palo-alto-modules-timestamp/289436/7 "2021-12-16T05:21:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.