you have helped me to write the rule, it was like “$message.timestamp”
if i change it to “$message.Timestamp”, will it be fixed?
because Timestamp is correct.
you have helped me to write the rule, it was like “$message.timestamp”
if i change it to “$message.Timestamp”, will it be fixed?
because Timestamp is correct.