Elastic Agent not matching @timestamp

Elastic Stack Elastic Agent
1

Hello,
I migrated to Elastic Agent from Filebeat and I am having trouble getting the log timestamp to match the @timestamp. My configuration goes from Elastic Agent -> Logstash -> elasticsearch. I have this in my elastic-agent-pipeline.conf:

date {
         match => [ "tstamp", "yyyy-MM-dd HH:mm:ss.SSS", "ISO8601", "yyyy-MM-dd HH:mm:ss" ]
}
mutate {
	remove_field => ["tstamp"]
 }

It just seems to ignore it completely, no date parse failure or anything.

Any suggestions?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.