Change logstash default @timestamp format

[markedperf]

I am looking to change the default @timestamp format from nano seconds ("@timestamp" : "2023-01-07T17:26:16.969990782Z") to just milliseconds ("@timestamp" : "2023-01-07T17:26:16.969" or "@timestamp" : "2023-01-07T17:26:16.969Z"). I have seen a lot of examples with a conf file with date filter, gsub, etc.. but nothing seems to work, it always produces "@timestamp" : "2023-01-07T17:26:16.969990782Z" format. Is there another place I should be looking or a way in the conf file that works? thanks.

[Badger]

You can do it using

    ruby { code => 'event.set("[@metadata][ts]",  event.get("@timestamp").to_s.sub(/(\d{3})\d{6}/, "\\1"))' }
    date { match => [ "[@metadata][ts]", ISO8601 ] }

That does not round the milliseconds, it just drops the last six digits, but that is what you asked for

[markedperf]

That worked. thank you!