Hello,
I noticed that filebeat stderr has a different format than stdout. That makes it impossible to parse filebeat logs with the same rule:
here is an example:
{"log":"{\"level\":\"debug\",\"timestamp\":\"2020-12-04T18:25:11.858Z\",\"logger\":\"processors\",\"caller\":\"processing/processors.go:128\",\"message\":\"Fail to apply processor client{timestamp=[field=timestamp, target_field=@timestamp, timezone=UTC, layouts=[2006-01-02T15:04:05.999Z]], rename=[{From:caller To:class}]}: failed to get time field timestamp: key not found\"}\n","stream":"stderr","time":"2020-12-04T18:25:11.858448537Z"}
so, for stdout we have timestamp field, but for stderr it is time
is this expected?