Use @timestamp in a _update_by_query

OK - good spot.

Without the dot it still complains about an "unexpected character [@]"

I suspect it's hsving all the curl in a file actually...if I just put the payload in and send that to curl I might be good.