Timestamp field not populating correctly


(Rich Willars) #1

Hi all. I've got functionbeat working on a AWS lambda, and it's populating all fields correctly apart from the timestamp.

{
          "@timestamp": event.ts,
          labels: {
            env: process.env.NODE_CONFIG_ENV,
          },
          service: {
            name: "Foobar"
          },
          event: {
            action: "foo",
            category: "actions",
            created: now.toISOString(),
          },
          user: {
            id: event.userId
        }

... etc..

Unfortunately it doesn't seem to pickup the @timestamp field (which is an ISO8601 formatted date string). When I view it in Kibana @timestamp seems to be the date that the record got indexed by Elasticsearch. Event.created is correct as well as the value of @timestamp in 'message' (the raw log).

Any ideas on why functionbeat isn't picking up the @timestamp I've specified?


(Rich Willars) #2

Solved! I set "json.overwrite_keys: true" in the functionbeat config file and that did the trick