How to have provide value for @timestamp when using JSON?


#1

I send a JSON object string to logstash, and one of the keys of the JSON object is @timestamp with a timestamp I've generated, but when I put it into logstash I get @timestamp which is generated by logstash, and @_timestamp which is the value I set. How can I provide a custom timestamp value directly from the application?

Is it possible to do this without using filters or modifying the logstash config file?


(Sachin Frayne) #4

Use a date filter, that'll do it, :slight_smile:


(Sachin Frayne) #5

Sorry I re-read your question and now I am not sure what you mean by custom timestamp, can you please clarify? Maybe with an example?


#6

It can be done provided the @timestamp is in the right format. For example, with the logstash.conf containing

input { stdin { codec => "json" } }
output { stdout { codec => rubydebug } }

and no filters, if you feed it these two lines

{ "@timestamp" : "2018-02-08T11:00:00.000Z" }
{ "@timestamp" : "2018-02-08 14:56:29" }

then for the first one you will get

"@timestamp" => 2018-02-08T11:00:00.000Z,

but for the second line you get an _@timestamp and logstash adds it own @timestamp. So you would need to use a date filter if your @timestamp is not in the format logstash expects.

"@timestamp" => 2018-02-08T20:04:37.085Z,
"_@timestamp" => "2018-02-08 14:56:29",
"tags" => [
[0] "_timestampparsefailure"
]


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.