I'm trying to ship log files from Filebeat into Logstash but I got an issue with @timestamp format
Here is one example of line Filebeat read from the file :
You notice there is a comma between the second and the millisecond : 16 , 911Z
Here is the configuration of filebeat.yml :
- type: log enabled: true paths: - c:\data\ds\*.log* json.keys_under_root: true json.overwrite_keys: true json.add_error_key: true json.expand_keys: true fields_under_root: true
And the error I got :
[jsonhelper] jsontransform/jsonhelper.go:55 JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-12-28T01:03:16,911Z" as "2006-01-02T15:04:05Z07:00": cannot parse ",911Z" as "Z07:00"
How to get rid of it? If I can't explain to Filebeat how to convert timestamp, is it possible to tell him to change the field name from @timestamp to something else?