# \[Solved\] Use grok'd timestamp across multiple messages

**URL:** <https://discuss.elastic.co/t/solved-use-grokd-timestamp-across-multiple-messages/64220>\
**Category:** Logstash\
**Created:** [October 27, 2016, 11:27pm UTC](https://discuss.elastic.co/t/solved-use-grokd-timestamp-across-multiple-messages/64220 "2016-10-27T23:27:49Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![AtTheControls](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@AtTheControls](https://discuss.elastic.co/u/AtTheControls)\
**Post date:** [October 28, 2016, 2:32pm UTC](https://discuss.elastic.co/t/solved-use-grokd-timestamp-across-multiple-messages/64220/4 "2016-10-28T14:32:25Z")

</div>

Thanks Ed - tried that earlier and there were issues. However, I have literally just found the answer thanks to another article: [https://discuss.elastic.co/t/keeping-global-variables-in-ls/39908](https://discuss.elastic.co/t/keeping-global-variables-in-ls/39908).

Relevant portion of the code updated:

```
if [message] =~ "^zzz" {
    	grok {
    		match => ["message", "%{DATA:field1} +%{DATA:field2} +%{MONTH:month} +%{NUMBER:day} +%{TIME:time} +%{DATA:field4} +%{YEAR:year}"]
    	}
    	mutate {
    		add_field => {
    			"timestamp" => "%{day} %{month} %{year} %{time}"
    		}
    	}
    	ruby {
    		init => "@@timestamp = ''"
    		code => "@@timestamp = event['timestamp']"
    	}
    	drop {}
    } else {
    	grok {
    		match => ["message", "%{DATA:device} +%{NUMBER:read_request_merge_avg:float} +%{NUMBER:write_request_merge_avg:float} +%{NUMBER:read_iops_avg:float} +%{NUMBER:write_iops_avg:float} +%{NUMBER:kB_read_avg:float} +%{NUMBER:kB_write_avg:float} +%{NUMBER:avg_sector_size:float} +%{NUMBER:avg_queue_size:float} +%{NUMBER:io_wait_time_ms:float} +%{NUMBER:io_service_time_ms:float} +%{NUMBER:disk_util_perc:float}"]
    	}
    	ruby {
    		code => "event['timestamp'] = @@timestamp"
    	}
    }

```

Simple when you know how!

---

_[View the full topic](https://discuss.elastic.co/t/solved-use-grokd-timestamp-across-multiple-messages/64220)._