# Timestamps precision in beats
**URL:** https://discuss.elastic.co/t/timestamps-precision-in-beats/154646
**Category:** Beats
**Tags:** filebeat
**Created:** [October 30, 2018, 12:00pm UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646 "2018-10-30T12:00:37Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@George\_Sovetov](https://discuss.elastic.co/u/George_Sovetov)
#### Post date: [October 30, 2018, 12:00pm UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646/1 "2018-10-30T12:00:37Z")
What does Filebeat do about timestamps? Especially when "backpressure" feature is working.
More generally, how do I get synchronized timestamps?
On machines, time may misalign and, moreover, it may change while Filebeat is working. Therefore, it becomes impossible to see "surrounding" logs. On other hand, there is definitely possible to add some time synchronization logic.
---
### Author:  [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [October 30, 2018, 1:26pm UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646/2 "2018-10-30T13:26:06Z")
Hi @George_Sovetov,
Filebeat uses by default the time the log line was read, so if the read is delayed for any reason this time won't be accurate. But in addition to that, filebeat modules use to include processors that replace this timestamp with the time stored in the log itself, that should be as accurate as the system monitored. In general it should be enough if all the monitored systems have a synchronized time, what can be achieved using NTP.
Times are sent in UTC by default, what should prevent problems with daylight saving time changes and so on.
What is your use case? do you need more accurate time synchronization?
---
### Author:  [@George\_Sovetov](https://discuss.elastic.co/u/George_Sovetov)
#### Post date: [October 30, 2018, 2:18pm UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646/3 "2018-10-30T14:18:59Z")
Hi @jsoriano
I use VMs to test software and intentionally change system time on VMs as part of the tests. That's why I cannot rely on system time or use NTP. (Unusual, I know.)
Logstash/Elasticsearch servers have correct time.
Communication between VM and Logstash/Elasticsearch servers is quite quick.
Does that mean that the best I can do is to use timestamp added by Logstash?
---
### Author:  [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [October 30, 2018, 2:28pm UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646/4 "2018-10-30T14:28:06Z")
Yes, then I guess that then the best you can do is to add a timestamp in logstash, but take into account that this will be the time when the log line was processed by logstash, that will surely contain some delay.
---
### Author:  [@George\_Sovetov](https://discuss.elastic.co/u/George_Sovetov)
#### Post date: [October 30, 2018, 2:39pm UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646/5 "2018-10-30T14:39:08Z")
BTW, when file is read, is it done using `poll`/`select` with timeouts or file just checked on regular basis (every second)? In second case I'll get extra delay up to checking period...
---
### Author:  [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [October 30, 2018, 2:58pm UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646/6 "2018-10-30T14:58:54Z")
Once haversting of a file has started, it is read by default as soon as there is available content, more in a `select` fashion. `close_inactive` can be used to close inactive files so there are not so many files open at the same time.
For new files there can be some delay, filebeat checks by default every 10 seconds for new files, this can be customized with [`scan_frequency` setting](https://www.elastic.co/guide/en/beats/filebeat/6.4/filebeat-input-log.html#filebeat-input-log-scan-frequency).
Also, once the logs are read they are sent to logstash in batches, so there can be an additional delay till a batch is ready to be sent, there are some settings to control that, like [`bulk_max_size`](https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html#_literal_bulk_max_size_literal_2).
---
### Author:  [@George\_Sovetov](https://discuss.elastic.co/u/George_Sovetov)
#### Post date: [October 30, 2018, 3:04pm UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646/7 "2018-10-30T15:04:07Z")
It's very clear now. Thank you a lot, @jsoriano!
---
### Author:  [@George\_Sovetov](https://discuss.elastic.co/u/George_Sovetov)
#### Post date: [November 21, 2018, 8:20pm UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646/8 "2018-11-21T20:20:49Z")
Hi @jsoriano,
I'm currently implementing what we've discussed here above and got a problem. Logstash takes `@timestamp` field from Filebeat, and I couldn't find the way to make reset `@timestamp` field in event received from Filebeat. Is it possible to use time from Logstash machine with beats?
---
### Author:  [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [November 22, 2018, 11:56am UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646/9 "2018-11-22T11:56:38Z")
Hi @George_Sovetov,
Take a look to [this thread](https://discuss.elastic.co/t/add-field-timestamp-with-current-time/59862). As the events will probably have already a `@timestamp` logstash won't set it to its current time, but you can use the ruby scripting filter to do whatever you want.
---
### Author:  [@George\_Sovetov](https://discuss.elastic.co/u/George_Sovetov)
#### Post date: [November 22, 2018, 12:24pm UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646/10 "2018-11-22T12:24:15Z")
Will it have any performance implications?
---
### Author:  [@George\_Sovetov](https://discuss.elastic.co/u/George_Sovetov)
#### Post date: [November 22, 2018, 1:31pm UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646/11 "2018-11-22T13:31:21Z")
What I ended up with now is:
```
if [@metadata][beat] == "filebeat" {
ruby {
code => "event.set('logstash_processed_at', Time.now());"
}
}
```
Found it here: [Add current timestamp to a logstash\_processed\_at field](https://discuss.elastic.co/t/add-current-timestamp-to-a-logstash-processed-at-field/109745/3?u=george_sovetov)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 20, 2018, 1:31pm UTC](https://discuss.elastic.co/t/timestamps-precision-in-beats/154646/12 "2018-12-20T13:31:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.