Parse date from @timestamp

Elastic Stack Logstash
1

Hello,

I'm trying to replace the date in kibana with the date from the logfile, which gets pre-parsed with the json parser from filebeat and looks like this:

{
    "@timestamp": "2024-06-19T10:00:00.469Z",
    "log.level": "WARN",
    "message": "xxx"
}

For some reasons, the date filter fails:

date {
    match => [ "@timestamp", "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'" ]
    tag_on_failure      => "_dateparsefailure_x"
    add_tag => [ "date_replaced" ]
}

The @timestamp in kibana still isn't the timestamp from the file. Any ideas why?

2

What does the event look like if you use output { stdout { codec => rubydebug } } (specifically, are there quotes around the value of @timestamp)? What value do you see for @timestamp in Kibana for that event?

3

Unfortunately, I can't change the outpout right now.

Yes, there are quotes around the value as shown in my first post. The value in Kibana is a few minutes later. I assume it's the timestamp when logstash first saw the event.

4

That's JSON, not rubydebug. What does it look like in rubydebug output?