Hi,
Can I get some clarification around how filebeat handles an inbound timestamp field of nanosecond precision when it uses that field to set @timestamp? Also, can filebeat generate nanosecond timestamps?
Filebeat is Go based and uses the time package, so it can handle nanosecond precision internally.
You can either use the timestamp processor to parse an inbound field with a nanosecond layout, or set the global timestamp.precision: nanosecond option to raise the precision ceiling for all timestamps Filebeat handles.
But that's just Filebeat's processing capability Elasticsearch's @timestamp still defaults to date (ms) mapping, so unless you explicitly override it to date_nanos, it gets rounded on indexing.