# What is the significance of read\_timestamp and how to specify it in filebeat config

**URL:** <https://discuss.elastic.co/t/what-is-the-significance-of-read-timestamp-and-how-to-specify-it-in-filebeat-config/103519>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 11, 2017, 9:26am UTC](https://discuss.elastic.co/t/what-is-the-significance-of-read-timestamp-and-how-to-specify-it-in-filebeat-config/103519 "2017-10-11T09:26:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![an.secure](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@an.secure](https://discuss.elastic.co/u/an.secure)\
**Post date:** [October 11, 2017, 9:26am UTC](https://discuss.elastic.co/t/what-is-the-significance-of-read-timestamp-and-how-to-specify-it-in-filebeat-config/103519/1 "2017-10-11T09:26:29Z")

</div>

Official documentation says :  
read\_timestamp  
In case the ingest pipeline parses the timestamp from the log contents, it stores the original @timestamp (representing the time when the log line was read) in this field.

However I am not able to figure how and where to use this read\_timestamp? what is the use case where it will be helpful.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [October 12, 2017, 3:27pm UTC](https://discuss.elastic.co/t/what-is-the-significance-of-read-timestamp-and-how-to-specify-it-in-filebeat-config/103519/2 "2017-10-12T15:27:22Z")

</div>

You can't configure in the Filebeat config if you want to this field or not. An interesting value you could get out of it is the difference in the time when the event was read vs when the log event actually happened. If you don't need to the field best just ignore it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2017, 3:27pm UTC](https://discuss.elastic.co/t/what-is-the-significance-of-read-timestamp-and-how-to-specify-it-in-filebeat-config/103519/3 "2017-11-09T15:27:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.