# Timestamp of When ElasticSearch Receives Data?

**URL:** <https://discuss.elastic.co/t/timestamp-of-when-elasticsearch-receives-data/226408>\
**Category:** Elasticsearch\
**Created:** [April 3, 2020, 1:34pm UTC](https://discuss.elastic.co/t/timestamp-of-when-elasticsearch-receives-data/226408 "2020-04-03T13:34:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![redapplesonly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redapplesonly/32/57700_2.png) [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Post date:** [April 3, 2020, 1:34pm UTC](https://discuss.elastic.co/t/timestamp-of-when-elasticsearch-receives-data/226408/1 "2020-04-03T13:34:01Z")

</div>

Hi ELK Gurus,

I have a pipeline of Docker containers, ending in an ELK stack of Logstash/Elasticsearch/Kibana. (ELK versions are 7.4.0, I know I need to upgrade.) Data flows into the pipeline from an external source, then is passed along all five containers until it is visible in Kibana. Everything works great and I’m very happy with ELK.

But recently my boss asked me if we could enhance the data by having Logstash run some DNS lookups and/or consult with an external database. My immediate worry is the end-to-end processing delay this would incur for my data records. I’d like to tell him, “_Right now, it takes .1 ms (or whatever) between the time the data first enters the pipeline and when that data is visible in Kibana. If I add in a DNS/database lookup, that will add ~200 ms per record._”

My raw data schema includes an initial timestamp. Is there any way to get the timestamp of when Elasticsearch or Kibana first sees the same data? That way, I could take the delta between the two and time out how long it takes a data record to traverse my ELK pipeline. Thank you.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 3, 2020, 1:43pm UTC](https://discuss.elastic.co/t/timestamp-of-when-elasticsearch-receives-data/226408/2 "2020-04-03T13:43:48Z")

</div>

If you are using ingest processors, you can access the ingest metadata, which contains a timestamp of the retrieval of the document by Elasticsearch.

See [https://www.elastic.co/guide/en/elasticsearch/reference/7.6/accessing-data-in-pipelines.html#accessing-ingest-metadata](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/accessing-data-in-pipelines.html#accessing-ingest-metadata)

---

<div class="post-metadata">

**Author:** ![redapplesonly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redapplesonly/32/57700_2.png) [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Post date:** [April 3, 2020, 3:12pm UTC](https://discuss.elastic.co/t/timestamp-of-when-elasticsearch-receives-data/226408/3 "2020-04-03T15:12:44Z")

</div>

Wow, thanks spinscale! Appreciate the tip

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2020, 3:12pm UTC](https://discuss.elastic.co/t/timestamp-of-when-elasticsearch-receives-data/226408/4 "2020-05-01T15:12:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.