I've tried updating my index template to allow an epoch and ISO8601 date format directly at the mapping level in Elasticsearch, which should override the @timestamp field. So far I've had no luck. My template can be viewed here http://pastebin.com/1DCT6GfM . Essentially, once I parse the json logs a…

Specifying custom date fields in an Elasticsearch index template

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Specifying custom date fields in an Elasticsearch index template