Filebeat -> @timestamp as eventtime

Elastic Stack Elasticsearch
1

Hi,

I have the following source log:

2016-12-08 18:56:49,666 INFO Field1="x" Field1="x1" Field3="3" Field4="4" Field5="5" Field6="x6" ............. Fieldn="xn"

It is shipped by filebeat to elasticsearch.

How can I set the event time "2016-12-08 18:56:49,666" as @timestamp?

Currently, @timestamp is equal to the time the event was indexed.

Thanks,
Lp

2

You either need to use ingest node, or Logstash to grok the event and break out the timestamp.
Filebeat will simply send the event as it.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.