# Winlogbeat doesnot have system logged time

**URL:** <https://discuss.elastic.co/t/winlogbeat-doesnot-have-system-logged-time/136830>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [June 21, 2018, 10:58am UTC](https://discuss.elastic.co/t/winlogbeat-doesnot-have-system-logged-time/136830 "2018-06-21T10:58:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mariyana](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@mariyana](https://discuss.elastic.co/u/mariyana)\
**Post date:** [June 21, 2018, 10:58am UTC](https://discuss.elastic.co/t/winlogbeat-doesnot-have-system-logged-time/136830/1 "2018-06-21T10:58:28Z")

</div>

hi

it has the @timestamp fileld. But this timestamp filed has the time when the event has been parsed by winlogbeat rather than the time when it has been logged(created) as windows event.

Please help me with this issue

Thanks  
Mariyana

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [June 21, 2018, 9:42pm UTC](https://discuss.elastic.co/t/winlogbeat-doesnot-have-system-logged-time/136830/2 "2018-06-21T21:42:09Z")

</div>

The `@timestamp` field is populated with the `TimeCreated` value from the Windows event log. ([source ref](https://github.com/elastic/beats/blob/v6.3.0/winlogbeat/eventlog/eventlog.go#L114))

Can you please enable `include_xml: true` for the event log in question. Then share the complete JSON event sent to Elasticsearch by Winlogbeat.

```auto
winlogbeat.event_logs:
- name: <SomeEventLog>
  include_xml: true # For debugging purposes only.

```

You can get the full JSON content from Kibana's Discover tab. Find an event the click on the JSON tab.

 ![kibana-discover-json](https://us1.discourse-cdn.com/elastic/original/3X/4/5/45abaad3e59a52715df686ae1baa334c18813cff.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 19, 2018, 9:42pm UTC](https://discuss.elastic.co/t/winlogbeat-doesnot-have-system-logged-time/136830/3 "2018-07-19T21:42:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.