Hi, We send multiple types of logs to Logstash and one of them uploaded JSON logs with an "@timestamp" field. Logstash tries to parse that field and when it fails it copies the value into "_@timestamp" and throws a warning message for log event. We DO NOT want to parse that field, we are happy w…

I figured out the issue, the problem was that since I used the JSON filter, it automatically parses the "@timestamp" and throws the warning. I had to get a little bit creative like this: if [log] =~ "^\{.*\}[\s\S]*$" { json { skip_on_invalid_json => true source => …

Discuss the Elastic Stack

Unable to ignore @timestamp in logs

Elastic Stack Logstash

Badger March 13, 2021, 7:02pm 4

You can use mutate+remove_field to remove the default @timestamp field, then set it to the current time using the configuration from this thread.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.