Keep Logstash from Crashing

Sounds like you've resolved this issue. But for other users who encounter this problem, another work around is to use add_field instead of rename in your mutate filter.

So use this:

mutate {
      add_field => { "read_timestamp" => "%{@timestamp}" }
   }

Instead of:

mutate {
      rename => { "@timestamp" => "read_timestamp" }
   }

The config in the docs should work with this change.

1 Like