Hi, We send multiple types of logs to Logstash and one of them uploaded JSON logs with an "@timestamp" field. Logstash tries to parse that field and when it fails it copies the value into "_@timestamp" and throws a warning message for log event. We DO NOT want to parse that field, we are happy w…

I figured out the issue, the problem was that since I used the JSON filter, it automatically parses the "@timestamp" and throws the warning. I had to get a little bit creative like this: if [log] =~ "^\{.*\}[\s\S]*$" { json { skip_on_invalid_json => true source => …

Unable to ignore @timestamp in logs

Elastic Stack Logstash

Badger March 13, 2021, 7:02pm 4

You can use mutate+remove_field to remove the default @timestamp field, then set it to the current time using the configuration from this thread.

Topic		Replies	Views
Logstash JSON parsing of @timestamp Logstash	5	1923	August 29, 2018
Log with @timestamp value in it - getting errors Logstash	2	368	December 18, 2019
@timestamp cannot be deleted - overwriting does not work Logstash	6	713	August 15, 2017
Logstash Json filter re-formated the @timestamp field unexpectedly Logstash	6	1505	July 13, 2020
Replace @timestamp or add new field with time from log file Logstash	4	501	January 6, 2020

Unable to ignore @timestamp in logs

Related topics