Timestamp format while overwriting


(Frank Solli) #1

Hello, Is it possible to change the timestamp format for a logfile within filebeat?

I get this error so I need to change it.

2017-07-27T14:41:03+02:00 ERR JSON: Won't overwrite @timestamp because of parsing error: parsing time "2017-05-12T18:58:42+0000" as "2006-01-02T15:04:05Z07:00": cannot parse "+0000" as "Z07:00"


(Steffen Siering) #2

No, this currently not supported. Feel free to open an enhancement request.


(Frank Solli) #3

Do you have any suggestion on how I can ship the logs to Logstash with the correct timestamp?


(Steffen Siering) #4

if you don't store the timestamp in @timestamp, it will be shipped as string to logstash. This will allow you to parse the timestamp in logstash.
If you don't need multiline after json, you can also send the raw line to logstash and have logstash parse the json.


(Frank Solli) #5

Thank you for your reply, sadly it has to be sent as @timestamp due to difficulties changing the log format.


(Steffen Siering) #6

If you don't store the json in the root document the @timestamp field is not parsed by filebeat. This allows you to post-process/parse the document via elasticsearch ingest pipeline.

New ticket: https://github.com/elastic/beats/issues/4836


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.