How to replace @timestamp field in logstash aggregate filter map

Elastic Stack Logstash
1

I'm using the logstash aggregate filter. When the map is pushed upon timeout, I want to set the @timestamp field to be a specific valu.

I've tried using timeout_code => event.set('@timestamp', "2021-06-10T19:00:00.000Z").
I've tried this with Time.utc(2021, 6, 10, 19, 0, 0), and Time.utc(2021, 6, 10, 19, 0, 0).to_i
I've tried using the date filter both before and after the aggregate filter.

I either get nothing, or it spews out errors saying it doesn't like me trying to change the @timestamp field.

What can I do to update the @timestamp?

Thanks.

--John

2

@timestamp has to be a LogStash::Timestamp. You could try

event.set("@timestamp", LogStash::Timestamp.new(Time.utc(2021, 6, 10, 19, 0, 0))
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.