The rename function seems to work, although i have to change the name to avoid duplicate keys.
I'm trying to sort out the event.created field now. i get the following erroR:
{"type":"mapper_parsing_exception","reason":"failed to parse field [event.created] of type [date] in document with id 'SApSsG0BKXzrRSyIEpSm'. Preview of field's value: '1.5706212264142175E9'","caused_by":{"type":"illegal_argument_exception","reason":"failed to parse date field [1.5706212264142175e+09] with format [strict_date_optional_time||epoch_millis]","caused_by":{"type":"date_time_parse_exception","reason":"date_time_parse_exception: Failed to parse with all enclosed parsers"}}
when trying use the following log line with "created" being the field i'm renaming to event.created. It looks like it is in correct epoch format though.
{"created": 1570621231.4085894, "clientip": null, "clientid": null, "transactionid": "not_available", "levelno": 20, "}
So it seems the log file is formatted correctly but filebeat isn't taking it in the same format.