I have created eventLogTime field in logstash indexer and assign timestamp form the log. I have provided list of timestamp while doing this. Now the problem is when we are adding applications in centralized logging, some systems have timestamps which are not in the list provided in indexer.
Then it gives error (grokeparsefailure). Due to this I have decided to remove this filter, as its of less importance.
After commenting out this filer, I can still see eventLogTime field for new logs on Kibana?
I hope it should not be there for new logs.