Input kafka: the decorate_events option overwrites @timestamp

[zeenon]

Version: logstash-input-kafka (8.3.1)

• Operating System: Red Hat 7.2
• Logstash: 6.8.1
  I am using decorate_event in my kafka input section. It works nicely but unfortunatly, in combination with codec json, I lost @timestamp as time of indexation. My @timestamp is the time of recording in Kafka, same as [@metadata][kafka][timestamp] but I have lost the timestamp of indexing in logstash. So I have to rebuild my code in order not to use codec json in the kafka input section. Is it a normal behavior ?
  Thanks for your tips

[Badger]

If a json codec sees a field in the JSON called @timestamp it will overwrite @timestamp with it. You could use a ruby filter to capture the ingestion time

ruby { code => 'event.set("ingestedAt", LogStash::Timestamp.new(Time.now))' }

[zeenon]

it is not the case and if I set decorate_event to false, @timestamp is correct

[Badger]

If you look at the code, decorate_events just controls whether fields are added to [@metadata][kafka].

[zeenon]

already checked the code and you're right but if you run a logstash configuration, @timestamp is overwritten