Sounds like you've resolved this issue. But for other users who encounter this problem, another work around is to use add_field
instead of rename
in your mutate
filter.
So use this:
mutate {
add_field => { "read_timestamp" => "%{@timestamp}" }
}
Instead of:
mutate {
rename => { "@timestamp" => "read_timestamp" }
}
The config in the docs should work with this change.