Hello, Currently, I am using Elasticsearch v7.11 and filebeat v7.15 And I am retrieving owa logs from a directory on exchange. I noticed that the "@timestamp" and log message was way different. After further troubleshooting using the date processor I managed to get the logs with 2 hours difference. …

FALEN (Ali Can Saykal) November 29, 2021, 1:50pm 4

This topic can help you, i prefer the grok, its better for performance

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Filebeat: Time different between ingest time and Message log time