# Timestamp for global target
**URL:** https://discuss.elastic.co/t/timestamp-for-global-target/309358
**Category:** Logstash
**Created:** [July 11, 2022, 9:01pm UTC](https://discuss.elastic.co/t/timestamp-for-global-target/309358 "2022-07-11T21:01:29Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@INS](https://discuss.elastic.co/u/INS)
#### Post date: [July 11, 2022, 9:01pm UTC](https://discuss.elastic.co/t/timestamp-for-global-target/309358/1 "2022-07-11T21:01:30Z")
Hi I'm facing with case that I couldn't brake the setting for timestamp for the rest of messages
here my input:
```auto
input {
generator {
lines => [
"# snapshot,66472243,20220704061503",
"list_of_count(number 0000080, abort 0, onlist yes)",
"list_of_count(number 0000100, abort 0, onlist yes)",
"list_of_count(number 0000605, abort 0, onlist yes)",
"list_of_count(number 0000605, abort 0, onlist yes)",
"list_of_count(number 0000750, abort 0, onlist yes)",
"list_of_count(number 0000905, abort 0, onlist yes)",
"list_of_count(number 0006063, abort 0, onlist yes)"
]
count => 1
}
} # input
filter {
grok {
match => { break_on_match => "true"
"message" => [ "%{DATA:count}\(%{DATA:type} %{INT:numvalue}, %{DATA:status} %{INT:statusval:int}, %{DATA:list} %{DATA:listval}\)",
"# %{DATA:activity},%{DATA:val},%{GREEDYDATA:time}" ]
}
}
date {
match => ["time", "yyyyMMddHHmmss", "yyyy-MM-dd'T'HH:mm:ss'.'SSS'Z'", "UNIX"]
timezone => "Europe/Paris"
locale => "en"
remove_field => ["timestamp"]
}
mutate {
remove_field => ["host", "count", "fields", "@version", "input_type", "source", "tags", "type", "time"]
}
} #filter
output {
stdout { codec => rubydebug{} }
} # output
```
as You see @timestamp was set as a target for time, but it couldn't trigger for the rest of messages besides for the first line.
```auto
{
"activity" => "snapshot",
"@timestamp" => 2022-07-04T04:15:03.000Z,
"message" => "# snapshot,66472243,20220704061503",
"sequence" => 0,
"val" => "66472243"
}
{
"status" => "abort",
"message" => "list_of_count(number 0000080, abort 0, onlist yes)",
"sequence" => 0,
"listval" => "yes",
"@timestamp" => 2022-07-11T20:56:35.991Z,
"statusval" => 0,
"numvalue" => "0000080",
"list" => "onlist"
}
{
"status" => "abort",
"message" => "list_of_count(number 0000100, abort 0, onlist yes)",
"sequence" => 0,
"listval" => "yes",
"@timestamp" => 2022-07-11T20:56:35.992Z,
"statusval" => 0,
"numvalue" => "0000100",
"list" => "onlist"
}
```
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 12, 2022, 1:34am UTC](https://discuss.elastic.co/t/timestamp-for-global-target/309358/2 "2022-07-12T01:34:01Z")
Logstash events are independent from each other, only your first event has the date that you use as the `@timestamp` for the document, all the other events will get the auto-generated `@timestamp` from Logstash.
You need to treat your events as a multiline log, check [my answer in your other post](https://discuss.elastic.co/t/grok-for-data/309093/13).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 9, 2022, 1:34am UTC](https://discuss.elastic.co/t/timestamp-for-global-target/309358/3 "2022-08-09T01:34:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.