Hi, We send multiple types of logs to Logstash and one of them uploaded JSON logs with an "@timestamp" field. Logstash tries to parse that field and when it fails it copies the value into "_@timestamp" and throws a warning message for log event. We DO NOT want to parse that field, we are happy w…

I figured out the issue, the problem was that since I used the JSON filter, it automatically parses the "@timestamp" and throws the warning. I had to get a little bit creative like this: if [log] =~ "^\{.*\}[\s\S]*$" { json { skip_on_invalid_json => true source => …

Unable to ignore @timestamp in logs

Elastic Stack Logstash

Badger March 13, 2021, 7:02pm 4

You can use mutate+remove_field to remove the default @timestamp field, then set it to the current time using the configuration from this thread.

Topic		Replies	Views
@timestamp cannot be deleted - overwriting does not work Logstash	6	713	August 15, 2017
Replace @timestamp or add new field with time from log file Logstash	4	500	January 6, 2020
Unable to replace @timestamp with some other field in logstash Logstash	6	2309	September 19, 2017
Should I remove my original time stamp field in favor of @timestamp? Elasticsearch	1	1683	April 6, 2017
Replace @timestamp with actual timestamp from log file Logstash	16	96231	February 16, 2017

Unable to ignore @timestamp in logs

Related Topics