If newfield ends up containing "%{timestamp}" then there was to timestamp field in the event. If you show us a complete example of your configuration, the input messages, what you actually get, and what you'd like to get it'll be easier to help out.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.