I'm new to logstash so maybe my question will not make much sense but I have this problem. I have servers in multiple geographical locations. They send logs with log time that doesn't include year. At the moment I use @timestamp to sort logs which is great but I noticed that logs sorted this way are out of order when you consider log creation date on a remote server. So my idea is to merge minutes and seconds from log time into timestamp. Obviously, I'll be more than happy to do it other way if there is any.