Filebeat timestamp on docker input

Elastic Stack Beats
1

In case of docker input, filebeat attaches the @timestamp field from the docker timestamp. I want to capture the time when filebeat actually read this log along with the docker timestamp in a field, say, @filebeattimestamp. I couldn't find any way to do this. No processor seems to do this, neither does the fields parameter help.

Can anyone tell me on how to achieve this?

2

It's not possible to keep that timestamp. Do you mind opening an issue on Github?

3

Sure. https://github.com/elastic/beats/issues/8279

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.