Issue with Log4J @timestamp format

[vincent2mots (Vincent Le Roux)]

Hello there!

I'm trying to ship log files from Filebeat into Logstash but I got an issue with @timestamp format

Here is one example of line Filebeat read from the file :

{"@timestamp":"2022-12-28T01:03:16,911Z","hostName":"host1",...}

You notice there is a comma between the second and the millisecond : 16 , 911Z

Here is the configuration of filebeat.yml :

- type: log
  enabled: true
  paths:
    - c:\data\ds\*.log*
  json.keys_under_root: true
  json.overwrite_keys: true
  json.add_error_key: true
  json.expand_keys: true
  fields_under_root: true

And the error I got :

[jsonhelper]    jsontransform/jsonhelper.go:55  JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-12-28T01:03:16,911Z" as "2006-01-02T15:04:05Z07:00": cannot parse ",911Z" as "Z07:00"

How to get rid of it? If I can't explain to Filebeat how to convert timestamp, is it possible to tell him to change the field name from @timestamp to something else?

Best regards,

[vincent2mots (Vincent Le Roux)]

No idea?