I had this problem with a different module. My solution only worked for me because the logs came through in real time. If you need an older timestamp, this probably won't work.
My current "workaround" is removing any timestamp-related modification in the ingest pipeline:
- /usr/share/filebeat/module/system/(auth or syslog)/ingest/pipeline.json on Linux
***Not sure where this lives on Windows
After editing this file, you have to delete the old ingest pipeline (the dev tools command will look something like this):
- DELETE _ingest/pipeline/filebeat-7.2.0-system-*
Once the old pipeline is deleted, restart filebeat. The new pipeline will be registered and the @timestamp should be current.