Ok just so that we have a good thread.
Open an new thread something along the "Parse message and set timestamp with ingest Processor"
In please include the a full sample document as it appears in elasticsearch in json..
Also include what kind of filebeat input you are using / your filebeat config.
Then we can go from there.