Copy `@timestamp` in Logstash

[amomchilov]

I would like to preserve the @timestamp field prior to overwriting it from a date filter, so that I can know when a document was processed by logstash.

I also tried using the copy filter, but that fails silently.

  mutate {
      copy => { "%{@timestamp}" => "logstash_intake_timestamp" }
  }

I tried this, but it also caused exceptions (I don't have the stack trace right now, but I could get it if it would help the investigation).

  mutate {
      copy => { "@timestamp" => "logstash_intake_timestamp" }
  }

I tried using the event API, but it leads to this exception.

ruby {
    code => "event.set('read_time', event.get('@timestamp'))"
}

What's the correct way to copy @timestamp?

[Christian_Dahlqvist]

Might something like this work?

mutate {
  add_field => { "logstash_intake_timestamp"=> "%{@timestamp}" }
}

[amomchilov]

Oh boy, I didn't RTFM:

@copy (emphasis mine)

Copy an existing field to another field. Existing target field will be overriden.

@add_field (emphasis mine)

If this filter is successful, add any arbitrary fields to this event. Field names can be dynamic and include parts of the event using the %{field}.

I'll try this tomorrow and report back!