# Year is missing from original log file, log events are stored as current year
**URL:** https://discuss.elastic.co/t/year-is-missing-from-original-log-file-log-events-are-stored-as-current-year/322300
**Category:** Beats
**Tags:** filebeat
**Created:** [January 2, 2023, 11:11am UTC](https://discuss.elastic.co/t/year-is-missing-from-original-log-file-log-events-are-stored-as-current-year/322300 "2023-01-02T11:11:27Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@r123](https://discuss.elastic.co/u/r123)
#### Post date: [January 2, 2023, 11:11am UTC](https://discuss.elastic.co/t/year-is-missing-from-original-log-file-log-events-are-stored-as-current-year/322300/1 "2023-01-02T11:11:27Z")
Hi there,
I have been testing the ELK-Stack recently. The ELK-Stack runs on a standalone server (elk-host01)
After setting everything up, I have installed the elastic-agent on another server (srv-docker01). The logs are sent by filebeats to elasticsearch and I can see them in Kibana. So, this is working so far.
But the logs are saved with a timestamp from the current year (2023), even if they were from 2022 or older. This seems to be caused by the missing year in the original log files.
```auto
// original entry from /var/log/auth.log
Jan 2 11:52:51 v2202002114686109779 sshd[7079]: Failed password for invalid use r dcmadmin from 106.10.122.53 port 43680 ssh2
```
I have seen some approaches for syslog (rsyslog and ng-syslog), but this would only apply for future log events.Any idea how to handle this issue for the existing logs that are already in the index?
Best regards.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 30, 2023, 1:11pm UTC](https://discuss.elastic.co/t/year-is-missing-from-original-log-file-log-events-are-stored-as-current-year/322300/2 "2023-01-30T13:11:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.