Using my own time field instead of the @timestamp automatically added by Filebeat

[snowfrogdev (Philippe Vaillancourt)]

I'm using the http_endpoint input with Filebeat.

I wanna use the timestamp field from my JSON payload instead of the @timestamp that Filebeat seems to add automatically.

filebeat.inputs:
  - type: http_endpoint
    enabled: true
    listen_address: filebeat
    listen_port: 8088

output.elasticsearch:
  hosts: "${ELASTICSEARCH_HOSTS:elasticsearch:9200}"

setup.kibana:
  hosts: "kibana:5601"

When I go to the index pattern section of the stack management section, I can see that my timestamp field is typed as a string and I can't select it as the official time field.

When I try to edit the type Date is not showing as an option in the list.

This ELK stack thing is going to be the death of me. It's a really cool suite of tools (yay for open source) but not exactly easy to configure. Thanks in advance for the help.

[stephenb (Stephen Brown)]

There are a few basic areas you should understand like mappings (schema), data types etc normal data store concepts etc.

But tl;dr you can use this to set the timestamp from the field in your message. (There are other ways as well but this is probably most direct)

Pay attention to date formats, dates are an important concept in time series data.

Anything of value takes some investment.