Json @timestamp vs date {}

From what i see, one should use in logstash the date {} to modify the event date, but setting the @timestamp field to seems to also work, at least when using json {}, @timestamp object seems to set the date correctly.

I have the json (from a nginx-ingress)
{ "@timestamp": "2021-07-03T23:17:15+00:00", ...}

And after a json {} i get in kibana:
|@timestamp |2021-07-04 , 00:17:15.000|
| logstash_time |2021-07-04 , 00:17:17.000|

The logstash_time is the date/time of the logstash when processed the event

So this seems to work, is this safe? or i should still use date {} to the @timestamp (if even works using date on the same field as the date target)

The documentation says

If the parsed data contains a @timestamp field, the plugin will try to use it for the events @timestamp , and if the parsing fails, the field will be renamed to _@timestamp and the event will be tagged with a _timestampparsefailure .

So you do not need to use a date filter.

1 Like

Thanks, i started using json long ago, i end miss that part of the documentation. Its perfect then, thanks for the confirmation!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.