Elastic Agent not matching @timestamp

I migrated to Elastic Agent from Filebeat and I am having trouble getting the log timestamp to match the @timestamp. My configuration goes from Elastic Agent -> Logstash -> elasticsearch. I have this in my elastic-agent-pipeline.conf:

date {
         match => [ "tstamp", "yyyy-MM-dd HH:mm:ss.SSS", "ISO8601", "yyyy-MM-dd HH:mm:ss" ]
mutate {
	remove_field => ["tstamp"]

It just seems to ignore it completely, no date parse failure or anything.

Any suggestions?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.