Set Timestamp of multiple events by one specific event


I have an application log file, containing one json-object per line. The schema of the file is this.

	"step": "text",
	"msg": "text",
	"tags": "array",
	"keyValues": "object"

The problem I have is, that there is no timestamp in each line, an because of this I use the scan-time from filebeat instead. But the real and wanted timestap is located in a specific line like this.


My questtion is: Is there a way to set / update the @timestamp-field all events from this file to this "startTime"-field? And if yes, how?

Thanks in advance,

This is currently not possible in Filebeat. It might be possible in the future with the rename processor:

For now you have to use either an ingest pipeline or Logstash to move the field around.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.