Assigning the received timestamp in Logstash may not always be entirely accurate, as it is possible for Logstash to process an event and then have to retry sending it to Elasticsearch a number of times. It is however likely that only a limited number of events would be be affected by this. Another option might be to assign it in an ingest pipeline once it reaches Elasticsearch, as shown in this example.