Hi Badger,
The rsyslog.timestamp is defined by myself in the dissect processor.
processors:
- dissect:
tokenizer: "%{rsyslog.timestamp} %{rsyslog.hostname} %{programname}: %{severity} %{swift_logs}"
field: "message"
target_prefix: ""
How's right way to assign a field abc.efg to be the @timestamp in logstash?