Recent versions of filebeat allow to dissect log messages directly. (Without the need of logstash or an ingestion pipeline.)
Therefore I would like to avoid any overhead and send the dissected fields directly to ES.
Currently I have two timestamps, @timestamp containing the processing time, and my parsed timestamp containing the actual event time.
Is it possible to set @timestamp directly to the parsed event time?
(Or is there a good reason, why this would be a bad idea?)
For reference, this is my current config.
filebeat.yml:
filebeat.inputs:
- type: log
tags: ["ingestion"]
multiline.pattern: '^\d{4}-\d{2}-\d{2}T'
multiline.negate: true
multiline.match: after
paths:
- '/druid/var/druid/task/*/log'
processors:
- dissect:
tokenizer: "%{timestamp} %{loglevel} [%{component}] %{class} - %{message}"
field: "message"
target_prefix: "ingest"
- dissect:
tokenizer: "/druid/var/druid/task/%{task-id}/log"
field: "source"
target_prefix: "ingest"
- include_fields:
fields: [ "ingest", "message" ]
output.elasticsearch:
hosts: ["${ES_URL}"]
index: "ingest-%{+yyyy.MM.dd}"
setup.template.enabled: true
setup.template.overwrite: true
setup.template.name: "ingest"
setup.template.pattern: "ingest-*"
setup.template.fields: "fields.yml"
fields.yml:
- name: main
type: group
description: >
What is this additional main level good for?
fields:
- name: ingest
type: group
description: >
Parsed values of the ingestion tasks.
fields:
- name: timestamp
type: date
description: >
The actual timestamp.
- name: loglevel
type: keyword
description: >
The loglevel.
- name: message
type: text
description: >
The actual message.