Can you use copy_fields processor for @timestamp in winlogbeat

Elastic Stack Beats
1

Hi guys,

Does anyone know if there is a way to copy the @timestamp value from winlogbeat json to a separate field (for troubleshooting purposes) using winlogbeat.yml file?

I'm trying to use the copy fields processor:

  - copy_fields:
      fields:
        - from: @timestamp
          to: original_event_timestamp

But I just get: Failed to copy fields in copy_fields processor: could not fetch value for key: @timestamp, Error: key not found

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.