Copy `@timestamp` in Logstash

Elastic Stack Logstash
1

I would like to preserve the @timestamp field prior to overwriting it from a date filter, so that I can know when a document was processed by logstash.

I also tried using the copy filter, but that fails silently.

  mutate {
      copy => { "%{@timestamp}" => "logstash_intake_timestamp" }
  }

I tried this, but it also caused exceptions (I don't have the stack trace right now, but I could get it if it would help the investigation).

  mutate {
      copy => { "@timestamp" => "logstash_intake_timestamp" }
  }

I tried using the event API, but it leads to this exception.

ruby {
    code => "event.set('read_time', event.get('@timestamp'))"
}

What's the correct way to copy @timestamp?

1 Like
2

Might something like this work?

mutate {
  add_field => { "logstash_intake_timestamp"=> "%{@timestamp}" }
}
1 Like
3

Oh boy, I didn't RTFM:

I'll try this tomorrow and report back!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.