# Set Timestamp of multiple events by one specific event

**URL:** <https://discuss.elastic.co/t/set-timestamp-of-multiple-events-by-one-specific-event/124527>\
**Category:** Beats\
**Created:** [March 19, 2018, 10:09am UTC](https://discuss.elastic.co/t/set-timestamp-of-multiple-events-by-one-specific-event/124527 "2018-03-19T10:09:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robert\_D](https://avatars.discourse-cdn.com/v4/letter/r/53a042/32.png) [@Robert\_D](https://discuss.elastic.co/u/Robert_D)\
**Post date:** [March 19, 2018, 10:09am UTC](https://discuss.elastic.co/t/set-timestamp-of-multiple-events-by-one-specific-event/124527/1 "2018-03-19T10:09:05Z")

</div>

Hello

I have an application log file, containing one json-object per line. The schema of the file is this.

```
{
	"step": "text",
	"msg": "text",
	"tags": "array",
	"keyValues": "object"
}

```

The problem I have is, that there is no timestamp in each line, an because of this I use the scan-time from filebeat instead. But the real and wanted timestap is located in a specific line like this.

```
{
	"step":null,
	"tags":["meta","start","monitoring"],
	"msg":"",
	"keyValues":{
		"runId":"ffa067058e27dc0a26705f59e6b6965357ac4637",
		"startTime":"2018-03-19T10:25:38+01:00",
	}
}

```

My questtion is: Is there a way to set / update the @timestamp-field all events from this file to this "startTime"-field? And if yes, how?

Thanks in advance,  
Robert

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 21, 2018, 7:00am UTC](https://discuss.elastic.co/t/set-timestamp-of-multiple-events-by-one-specific-event/124527/2 "2018-03-21T07:00:48Z")

</div>

This is currently not possible in Filebeat. It might be possible in the future with the rename processor: [https://github.com/elastic/beats/pull/6292](https://github.com/elastic/beats/pull/6292)

For now you have to use either an ingest pipeline or Logstash to move the field around.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2018, 9:00am UTC](https://discuss.elastic.co/t/set-timestamp-of-multiple-events-by-one-specific-event/124527/3 "2018-04-18T09:00:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.