How to change the @timestamp format in the Filebeat

Elastic Stack Beats
1

I configured below processor to change the @timestamp format.

        processors:
          - timestamp:
              field: '@timestamp'
              layouts:
                - '2006-01-02T15:04:05.999+07:00'

Filebeat logs are @timestamp format as2024-06-17T11:50:11.689+0300 but need to change the format to this 2024-06-17T11:50:11.689+03:00 is there any alternative approached .

when I was using this processor i was seen below log
{"log.level":"debug","@timestamp":"2024-06-17T11:50:11.689+0300","log.logger":"processor.timestamp","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/processors/timestamp.(*processor).parseValue","file.name":"timestamp/timestamp.go","file.line":152},"message":"Failure parsing time field.","service.name":"filebeat","error":{"message":"failed parsing time field json.@timestamp='2024-06-17T11:50:07.686+0300'","cause":[{"message":"failed using layout [2006-01-02T15:04:05.999-07:00] cannot parse [+0300] as [-07:00]"}]},"ecs.version":"1.6.0"}",

Thanks In advance

2

The timestamp processor is used to parse a timestamp field, not to change the format of the @timestamp field.

I don't think you can change the format that filebeat uses to write the @timestamp field.

3

Hi @Greeshma1 Welcome to Elastic community.

You can change it using timestamp and convert processor.

  - timestamp:
      field: "@timestamp"
      layouts:
        - '2006-01-02T15:04:05.000Z'
      test:
        - '2023-06-15T16:35:17.123Z'
  - convert:
      fields:
        - {from: "@timestamp", to: "@timestamp", type: string}

But i would suggest to store required format on another field.