Ok, ruby filter is the winner. This worked.
ruby {
code => "event.set('@timestamp', event.get('last_execution_time'));"
}
"last_execution_time" => 2017-03-09T04:07:51.520Z
"@timestamp" => 2017-03-09T04:07:51.520Z
Is that ok to use or do you know of a more optimal way ?
Thanks,
E