Logstash timestamp appearing as text in Elasticsearch

Elastic Stack Logstash
1

I am using Elasticsearch 7.3.1 and Logstash 7.3.1. I am trying to make a field of mine as the Elasticsearch timestamp using the date filter. The data is being inserted properly but the type of @timestamp is coming text. How do I fix this?

My input timestamp is like 1567408605794750813. My code is:

input {
  elasticsearch {
    hosts => "x.x.x.x"
    index => "raw"
    docinfo => true
  }
}
filter {
  mutate {
    convert => {
      "timestamp" => "integer"
    }
  }
  date {
    match => ["timestamp", "UNIX_MS", "ISO8601"]
    target => "@timestamp"
  }
}
output {
  elasticsearch {
    index => "logs-%{app_name}"
    document_id => "%{[@metadata][_id]}"
  }
}

After running the mapping API, I get

"@timestamp" : {
  "type" : "text",
  "fields" : {
    "keyword" : {
      "type" : "keyword",
      "ignore_above" : 256
    }
  }
}
2

As far as I can see that time stamp is not in milliseconds, but rather nanoseconds or similar which is not supported by Elasticsearch.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.