Timestamps for archived event logs are overwritten with current time

I've used the latest winlogbeat to ingest an archived evtx (sample taken from: GitHub - sbousseaden/EVTX-ATTACK-SAMPLES: Windows Events Attack Samples). The timestamp I see in Kibana when ingested via Logstash (without any filters, simple upload) the timestamp which is supposed to be an year back is showing current time.

When I've tried to dig further, I observed that the JS processors are the one's causing the issue. Any quick help please.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.