Kramer_Li
(Kramer Li)
April 6, 2016, 3:03am
1
The timestamp field usually have a "@" prefix. Why? What is the difference if we do not add it ?
warkolm
(Mark Walkom)
April 6, 2016, 3:05am
2
@ fields are usually ones generated by Logstash as metadata ones, @timestamp being the value that the event was processed by Logstash.
Kramer_Li
(Kramer Li)
April 6, 2016, 3:07am
3
Hi Mark
Nice to see you. Thanks for your answer. So it means we can change the @timestamp to timestamp if we want, right?
As long as we are not using logstash
Kramer_Li
(Kramer Li)
April 6, 2016, 3:10am
5
Thanks very much. I posted another question here
I have a template as below:
curl -XPUT localhost:9200/_template/template_flow_detail -d '
{
"template" : "flow_detail_*",
"mappings" : {
"traffic" : {
"properties" : {
"@timestamp": { "index": "not_analyzed", "type": "date","format": "epoch_second"},
"router_ip" : { "type" : "integer", "index" : "not_analyzed"},
"interface" : { "type" : "integer", "index" : "not_analyzed"},
"src_i…
Is it possible for you to have a look also? Thanks very much