Filebeat timestamp processsor doesn't parse microseconds part


this is the first part of my filebeat.xml

  - type: tcp
    enabled: true
    host: "localhost:9000"

  - decode_json_fields:
      fields: ["message"]
      process_array: true
      target: ""
      add_error_key: true
#      overwrite_keys: true
      max_depth: 2
  - timestamp:
      field: xxtimestamp
        - '2020-01-02T12:34:56.123456Z'
  - drop_fields:
      fields: [xxtimestamp]

(nothing fancy in the second part)

My application sends JSON messages to Filebeat through TCP. Filebeat parsing the messages add some Filebeat specific fields and forwards it to Elasticsearch/Kibana.

I have an xxtimestamp field in the JSON message which contains an ISO8601 timestamp, like '2020-01-02T12:34:56.123456Z'
I'd like to replace @timestamp's field content with xxtimestamp's content.

Its working with the config above but this method cuts off the microseconds part

e.g.: '2020-01-02T12:34:56.123456Z' -> '2020-01-02T12:34:56.123000Z

How could I increase this date precision?

I'm not convinced if it's not a bug. Filebeat should support up to nanoseconds precision for timestamps (for reference:

Which filebeat version are you using?

(apt show filebeat)

Package: filebeat
Version: 7.9.1
Priority: extra
Section: default
Maintainer: <@5834351aa1d6>
APT-Sources: stable/main amd64 Packages

(apt show kibana-oss)

Package: kibana-oss
Version: 7.9.1
Priority: optional
Section: default
Maintainer: Kibana Team <>
APT-Sources: stable/main amd64 Packages

(apt show elasticsearch-oss)

Package: elasticsearch-oss
Version: 7.9.1
Priority: optional
Section: web
Source: elasticsearch-oss
Maintainer: Elasticsearch Team <>
Depends: bash (>= 4.1), lsb-base (>= 4), libc6, adduser, coreutils (>= 8.4)
APT-Sources: stable/main amd64 Packages

Do you think the issue which you posted related to 7.9.1?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.