Copy different field with nanoseconds to elasticsearch/kibana @timestamp field

[savvy]

Copy another field with nanoseconds to elasticsearch/kibana @timestamp field

Hello, My Elasticsearch is version 7.5 I have a> date type - @timestamp field b> string type - event_timestamp field (format: 2020-03-06 20:28:33:232123456 +0000) sent in each event. What I want to achieve: 1st, I want to copy @timestamp field to another field called ls_timestamp (ls_timestamp should have same format as @timestamp after copying) 2nd, I want to copy event_timestamp field value to @timestamp (I want to see all the nanoseconds from event_timestamp in @timestamp after copying…

Just posting that here, seems like logstash related. Can someone guide me here?

[Badger]

You can use mutate+rename to move fields around, but you cannot have nanosecond precision for a logstash @timestamp field.

[savvy]

@Badger
Just curious, I thought date_nanos was introduced to achieve nanosecond precision in ES 7.0 onwards? Is it something work under progress then?

Then can I use event_timestamp (2020-03-09 04:58:54.497305256 +0000) in my case, for nano second precision by simply converting into date_nanos type? If so, what would my index template look like?

[Badger]

@savvy

I thought date_nanos was introduced to achieve nanosecond precision in ES 7.0

Yes, it was. Support for it may have been added in Kibana too for all I know. But it wasn't added in logstash.

[savvy]

Thanks @Badger.
I was doing this to be able to sort data based on @timestamp in nano precision level.
Just to share to everyone, As a workaround, I achieved this by changing event_timestamp field to date_nanos type and recreating index with event_timestamp. Now I am able to sort data on nano precision level based on my producer timing (event_timestamp).