# Would multiple events have same @timestamp when processed in batch

**URL:** <https://discuss.elastic.co/t/would-multiple-events-have-same-timestamp-when-processed-in-batch/111724>\
**Category:** Logstash\
**Created:** [December 14, 2017, 9:40am UTC](https://discuss.elastic.co/t/would-multiple-events-have-same-timestamp-when-processed-in-batch/111724 "2017-12-14T09:40:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dimitry\_Khan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dimitry_khan/32/47127_2.png) [@Dimitry\_Khan](https://discuss.elastic.co/u/Dimitry_Khan)\
**Post date:** [December 14, 2017, 9:40am UTC](https://discuss.elastic.co/t/would-multiple-events-have-same-timestamp-when-processed-in-batch/111724/1 "2017-12-14T09:40:01Z")

</div>

How logstash creates the @timestamp value for each record? So if I configure logstash.yml to process multiple events in batch all the events that are sampled in one batch should have same @timstamp. I have tested this, and the result confirms that understanding.  
But, I have one confusion, if I configure logstash with 1 event in batch and multiple workers, can two workers set same time to their sampled events. I tried to test it, but somehow not being able to produce enough result to be sure.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 14, 2017, 11:57am UTC](https://discuss.elastic.co/t/would-multiple-events-have-same-timestamp-when-processed-in-batch/111724/2 "2017-12-14T11:57:17Z")

</div>

> How logstash creates the @timestamp value for each record?

It grabs the current time.

> So if I configure logstash.yml to process multiple events in batch all the events that are sampled in one batch should have same @timstamp.

No, it won't have the same timestamp unless they happen to be processed within the same millisecond.

---

<div class="post-metadata">

**Author:** ![Dimitry\_Khan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dimitry_khan/32/47127_2.png) [@Dimitry\_Khan](https://discuss.elastic.co/u/Dimitry_Khan)\
**Post date:** [December 14, 2017, 1:06pm UTC](https://discuss.elastic.co/t/would-multiple-events-have-same-timestamp-when-processed-in-batch/111724/3 "2017-12-14T13:06:21Z")

</div>

Thanks @magnusbaeck.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2018, 1:11pm UTC](https://discuss.elastic.co/t/would-multiple-events-have-same-timestamp-when-processed-in-batch/111724/4 "2018-01-11T13:11:07Z")

</div>

Closed on January 11, 2018, 1:11pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.