Timestamp from log line in nginx JSON logs via filebeat / beats

[gsmith]

Hello,

@ufth

But when I update this extractor to use “timestamp”

I have seen this issue multiply times in the forum. I kind of understand what’s happening. The field
timestamp is there by default and you need to make another field so its not conflicting with each other. I’m not 100% sure but I think there is a fix.
On another note we have TAG"s now, just an FYI you can search for TimeStramp Issues. Not sure if you have seen this.

Correct me if I’m wrong but your time_iso8601 is the same time/date as the original log file?
Perhaps something like this will help

Timestamp Pipeline/rewrite from Filebeat

I’m using filebeat to retrieve logs written to a file every few minutes. The logs come in JSON format and are handled properly. There’s a field created called “CreationTime” representing the time in PST. I can convert that string to a datetime with a pipeline rule like the following: set_field("NewDateTime",(parse_date(to_string(new_date),"YYYY-MM-dd'T'HH:mm:ss"))); This works as expected, however, when I use a rule like: set_field("timestamp",(parse_date(to_string(new_date),"YYYY-MM-dd'T'HH:…