Csv plugin cooperating with multiplying pattern

I would use

ruby { code => '@@metadata = event.get("@timestamp")' }

for the snapshot lines, and

ruby { code => 'event.set("@timestamp", @@metadata)' }

for the others.

1 Like