Moving @timestamp in an optionnal new field

Elastic Stack Beats
1

hi,
i want to add a new field in my config filebeat and put in it the @timestamp value :

fields:
harvest_timestamp: @timestamp

but it doesn't work ...
my goal, at the end, is to delete the field @timestamp and just keep the new field 'harvest_timetamp'. Thus, my logstash shipper, output in my config, will create his own @timestamp... and i will know :
1 - the harvest timestamp
2 - the shipping timestamp

A solution exists please ? ty

2

you can not rename fields in filebeat directly. You have to do this kind of processing in logstash, but no idea if you can overwrite the @timestamp in logstash.

3

ty steffens for your answer (even if it doesn't help :joy:)

4

the timestamp is not set by output plugin, but by input plugins. Using ruby or mutate filter you can try to store @timestamp into harvest_timestamp and try to overwrite timestamp. Never tried, but with ruby filter you can try

ruby {
        code => 'event["[@timestamp]"] = Time.now'
}

Regarding questions about event processing in logstash, have a look at the logstash forum.

5

ty steffens it works !! :grinning: