Replace @timestamp with source log timestamp

Elastic Stack Logstash
24

Glad you got it working, also thanks for the explanation, makes sense.

With four separate filters like:

filter {
if "#Version: 1.0" in [message] {
drop { }
     }
}

Just a note, I would replace those four filters with one:

filter {
  if [message] =~ /^#.*/ {
    drop {}
  }
}

Also, now that you got the @timestamp to work properly, you could add remove_fields -option in the date filter which would remove event_timestamp field if the date filter succeeds.