Copy value of @timestamp to another field

[mostpha456 (Mostpha)]

Hello,

I am trying to copy the value of @timestamp to new field timestamp keeping the same format.
Is that possible ? Do you have any suggestion ?

Thank you.

Mustapha

[warkolm (Mark Walkom)]

It'd be useful if you could share what you are trying, along with examples of why it's not working for you.

Otherwise we're guessing at what format you have and want to maintain.

[mostpha456 (Mostpha)]

Hello,
Thanks for the reply.
The default format of @timestamp "2021-09-20T13:08:56.181Z". I am trying copy the value of the field @timestamp in a new field using filebeat, but @timestamp is special beat.Event field, so i cant use processors to manipulate it.
Thank you.

[warkolm (Mark Walkom)]

Can you please share the config that you are trying to use.

[e_willemsen (Erwin Willemsen)]

Maybe this will help:

Copy `@timestamp` in Logstash

I would like to preserve the @timestamp field prior to overwriting it from a date filter, so that I can know when a document was processed by logstash. I also tried using the copy filter, but that fails silently. mutate { copy => { "%{@timestamp}" => "logstash_intake_timestamp" } } I tried this, but it also caused exceptions (I don't have the stack trace right now, but I could get it if it would help the investigation). mutate { copy => { "@timestamp" => "logstash_intake_ti…