# Set system time as timestamp

**URL:** https://discuss.elastic.co/t/set-system-time-as-timestamp/372079
**Category:** Logstash
**Created:** [December 17, 2024, 3:42pm UTC](https://discuss.elastic.co/t/set-system-time-as-timestamp/372079 "2024-12-17T15:42:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Taras\_Mikityuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taras_mikityuk/32/138210_2.png) [@Taras\_Mikityuk](https://discuss.elastic.co/u/Taras_Mikityuk)
#### Post date: [December 17, 2024, 3:42pm UTC](https://discuss.elastic.co/t/set-system-time-as-timestamp/372079/1 "2024-12-17T15:42:53Z")

</div>

I'm collecting logs using elastic agent. The problem is, in @timestamp field I have time when event actually happened, but I also need time when log arrived in logstash. I was thinking to use ruby(ruby { code =\> "event.set('systemtime', Time.now());" }) to get system time, but ruby is too slow. Also there arent any plugins with such functionality. Any suggestions?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 17, 2024, 4:09pm UTC](https://discuss.elastic.co/t/set-system-time-as-timestamp/372079/2 "2024-12-17T16:09:04Z")

</div>

> [@Taras\_Mikityuk](#):
>
> ruby is too slow

Why do you say that?

---

<div class="post-metadata">

### Author: ![Taras\_Mikityuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taras_mikityuk/32/138210_2.png) [@Taras\_Mikityuk](https://discuss.elastic.co/u/Taras_Mikityuk)
#### Post date: [December 18, 2024, 9:08am UTC](https://discuss.elastic.co/t/set-system-time-as-timestamp/372079/3 "2024-12-18T09:08:26Z")

</div>

Just my observations, i suppose

---

<div class="post-metadata">

### Author: ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [December 18, 2024, 12:39pm UTC](https://discuss.elastic.co/t/set-system-time-as-timestamp/372079/4 "2024-12-18T12:39:55Z")

</div>

Respectfully, it would be better to use something numeric to demonstrate this "slowness".

But clearly if you want to insert value of "now" into a document you need to look up when "now" is. Is there more efficient way than the ruby code, which is variant on what is posted each time this Q is asked?

Well, I dont know if it would be faster, but there are hacky ways, like parsing /proc/uptime. But I don't think there is a "pure" way.

PS: Not directly related, but in thinking about this, I discovered recent versions of bash have

$ printf "%s\n%s\n" ${EPOCHREALTIME} ${EPOCHSECONDS}  
1734525193.150271  
1734525193  
$ type -a printf  
printf is a shell builtin  
printf is /usr/bin/printf

which gives a exec/fork free way inside a shell script.
