Timestamp Generation Query

Elastic Stack Logstash
1

Hi,
When our logs hit logstash they already include an @timestamp field containing the timestamp of the log line. I also want to generate a timestamp to mark when the message was indexed...

How do I generate a timestamp equivalent to "now" so that it can be saved as an additional field?

Regards,
David

2

You used to be able to do this automatically with Elasticsearch, but the functionality is deprecated and will be removed in 5.X.

The best you can do is add another field with the current timestamp, at the end of your filters.