How to add another timestamp?

Elastic Stack Logstash
1

Hi,

I'm ingesting some logs containing a @timestamp using the json codec. This is working but I'd also like to save the timestamp containing the date and time logstash ingested my logs.

Can logstash create a new timestamp (not @timestamp but in a new field)? I want to use the @timestamp from my logs to analyze data so I don't want to touch that but for my use case the log time and ingestion time might be very different and it would be helpful in some cases to know when data was ingested.

2

Seems this is working.

  ruby {
     code => 'event.set("@ingest_time", Time.now.strftime("%Y-%m-%d %H:%M:%S"))'
  }
2 Likes
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.