Copy different field with nanoseconds to elasticsearch/kibana @timestamp field

Just posting that here, seems like logstash related. Can someone guide me here?

You can use mutate+rename to move fields around, but you cannot have nanosecond precision for a logstash @timestamp field.

Just curious, I thought date_nanos was introduced to achieve nanosecond precision in ES 7.0 onwards? Is it something work under progress then?

Then can I use event_timestamp (2020-03-09 04:58:54.497305256 +0000) in my case, for nano second precision by simply converting into date_nanos type? If so, what would my index template look like?

Yes, it was. Support for it may have been added in Kibana too for all I know. But it wasn't added in logstash.


Thanks @Badger.
I was doing this to be able to sort data based on @timestamp in nano precision level.
Just to share to everyone, As a workaround, I achieved this by changing event_timestamp field to date_nanos type and recreating index with event_timestamp. Now I am able to sort data on nano precision level based on my producer timing (event_timestamp).

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.