Hi,
We are pushing logs using below ELK stack
filebeat -> logstash -> ES
we would like to add a field when filebeat sees logs, when logstash sees the logs.
I understand filebeat already adds @timestamp by this we can know when filebeat read the logs.
But when logs reach logstash how do I get the current time so that I can add new field "ls-timestamp" to indicate when logs were received by logstash.
Reagrds
Chaitra