Timestamp of last attemp of ingestion

Logstash will set the timestamp when it creates the event. You can override that with a date filter. It doesn't change the timestamp if it has to hold the event in a queue.

If you want the timestamp to reflect the time when an event is indexed then I would suggest having elasticsearch add the timestamp, not logstash. This thread might help with that.

1 Like