Filebeat -> @timestamp as eventtime


I have the following source log:

2016-12-08 18:56:49,666 INFO Field1="x" Field1="x1" Field3="3" Field4="4" Field5="5" Field6="x6" ............. Fieldn="xn"

It is shipped by filebeat to elasticsearch.

How can I set the event time "2016-12-08 18:56:49,666" as @timestamp?

Currently, @timestamp is equal to the time the event was indexed.


You either need to use ingest node, or Logstash to grok the event and break out the timestamp.
Filebeat will simply send the event as it.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.