Filebeat / Winlogbeat -> Logstash -> Elastic '@timestamp' problem

I am capturing logs from hosts using winlogbeat and filebeat and sending them to the logstash, that is shipping them to the Elastic.
The problem I am facing, is that filebeat and winlogbeat as well as logstash are useing '@timestamp' field to store event timestamp. The thing is that logstash is rewriting this field with it's timestamp, making quite a mess in the logs.

Is there any way to tell logstash not to rewrite it? Of I do have to bring extra field and totally ignore @timestamp field at all?

Use the logstash date filter to set the @timestamp to the desired value from the event, for example:

       date {
          match => [
             "MMM  d HH:mm:ss",
             "MMM dd HH:mm:ss"
          target => "@timestamp"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.