In my json events I am actually looking for a "time" field and parse it, then removing it-
date {
match => [ "time", "ISO8601", "dd-MM-yyyy HH:mm:ss", "dd-MM-yyyy HH:mm:ss:SSS", "dd-MM-yyyy HH:mm:ss.SSS", "yyyy-MM-dd HH:mm:ss,SSS", "HH:mm:ss" ]
remove_field => ["time"]
}
I think i'll add a line to match "timestamp" as well, and remove it afterwards.
It's just weird to me that on one environment I don't get these exceptions and on another one I do.
Thanks!