I'm receiving batch event from azure eventhub and I am using split filter to split each event into it's own record
the problem I'm facing is that each split event has it's own datetime and I would like to use the as @timestamp
here is my filter so far but the records.time is still different from the @timestamp
source => "message"
field => "records"
match => ["records.time", "yyyy-MM-dd'T'HH:mm:ss'.'SSSZ"]
target => "@timestamp"