# Timestamps for archived event logs are overwritten with current time

**URL:** <https://discuss.elastic.co/t/timestamps-for-archived-event-logs-are-overwritten-with-current-time/256756>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [November 26, 2020, 10:46am UTC](https://discuss.elastic.co/t/timestamps-for-archived-event-logs-are-overwritten-with-current-time/256756 "2020-11-26T10:46:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![p1k4chu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/p1k4chu/32/79753_2.png) [@p1k4chu](https://discuss.elastic.co/u/p1k4chu)\
**Post date:** [November 26, 2020, 10:46am UTC](https://discuss.elastic.co/t/timestamps-for-archived-event-logs-are-overwritten-with-current-time/256756/1 "2020-11-26T10:46:46Z")

</div>

I've used the latest winlogbeat to ingest an archived evtx (sample taken from: [GitHub - sbousseaden/EVTX-ATTACK-SAMPLES: Windows Events Attack Samples](https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES)). The timestamp I see in Kibana when ingested via Logstash (without any filters, simple upload) the timestamp which is supposed to be an year back is showing current time.

When I've tried to dig further, I observed that the JS processors are the one's causing the issue. Any quick help please.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 24, 2020, 12:46pm UTC](https://discuss.elastic.co/t/timestamps-for-archived-event-logs-are-overwritten-with-current-time/256756/2 "2020-12-24T12:46:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.