# Timestamp ISSUE
**URL:** https://discuss.elastic.co/t/timestamp-issue/286170
**Category:** Logstash
**Created:** [October 8, 2021, 12:24am UTC](https://discuss.elastic.co/t/timestamp-issue/286170 "2021-10-08T00:24:51Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@frank\_rib](https://discuss.elastic.co/u/frank_rib)
#### Post date: [October 8, 2021, 12:24am UTC](https://discuss.elastic.co/t/timestamp-issue/286170/1 "2021-10-08T00:24:51Z")
Hello every body,
I have a stand allone architecture. Logs are sent from syslog\_ng server to logstash - \> Elasticsearch -\> kibana.
I have a probleme with the timestamp as the capture below shows
The logs are received at ELK at 2:11 AM but the timestamp show the logs receveid at 1:48 AM.
Did you have any idea about the solving of this issue?
Best regards,
---
### Author:  [@zx8086](https://discuss.elastic.co/u/zx8086)
#### Post date: [October 8, 2021, 1:27am UTC](https://discuss.elastic.co/t/timestamp-issue/286170/2 "2021-10-08T01:27:00Z")
Have you checked the times are the same on the sending system to logstash and then to Elasticsearch. You should also be able to add in Discover the ingest timing.. if there is a delay in ingestion and processing those documents.
---
### Author:  [@frank\_rib](https://discuss.elastic.co/u/frank_rib)
#### Post date: [October 11, 2021, 4:11pm UTC](https://discuss.elastic.co/t/timestamp-issue/286170/3 "2021-10-11T16:11:21Z")
> [@zx8086](#):
>
> . You should also be able to add in Discover the ingest timing.. if there is a delay in ingestion and processing those documents.
Thanks zx8086 for the reply, I added a field about the ingested date.
```auto
ruby {
code => 'event.set("@created_time", Time.now.utc)'
}
```
The field was added in the mapping:
> PUT /my-lab-\*/\_mapping
> {
> "properties": {
> "@created\_time": {
> "type": "date"
> }
> }
But the field type change as shown bellow
> {
> "my-lab-2021.10.11-000011" : {
> "mappings" : {
> "@created\_time" : {
> "full\_name" : "@created\_time",
> "mapping" : {
> "@created\_time" : {
> "type" : "keyword",
> "ignore\_above" : 2048
> }
> }
> }
> }
> },
> "my-lab-2021.10.11-000010" : {
> "mappings" : {
> "@created\_time" : {
> "full\_name" : "@created\_time",
> "mapping" : {
> "@created\_time" : {
> "type" : "date"
> }
> }
> }
> }
> }
Did you have about the correct way to add ingested.time ?
---
### Author:  [@zx8086](https://discuss.elastic.co/u/zx8086)
#### Post date: [October 11, 2021, 4:54pm UTC](https://discuss.elastic.co/t/timestamp-issue/286170/4 "2021-10-11T16:54:01Z")
Those ingested times were part of the existing template I had, maybe if you see if they are there id you ingest via a dynamic template ?
What is strange is the time variance is not in hours, which usually is points to a Time Zone mapping issue.
Are all the nodes using the same time server to start with (and there is no time drift)?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 8, 2021, 4:54pm UTC](https://discuss.elastic.co/t/timestamp-issue/286170/5 "2021-11-08T16:54:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.