Mgiyuk

Logstash use JSON field date instead of @timestamp I'm facing this issue. I'm trying to use custom JSON log date as my "usable" date instead of the @timestamp date field. My JSON file to be processed by Logstash (comming from filebeat): { "start": { "timestamp": { "time": "Wed, 04 Apr 2018 09:36:39 GMT", "timesecs": 1522834599 } } } My logstash.yml file : input { beats { port => 1337 codec => "json_lines" } } filter { date { match => [ "time", "EEE, dd MM yyyy hh:mm:ss ZZZ" ] } } output { stdout { codec => rubydebug } elasticsearch { hosts => "localhost:9200" index => "testing" } } Also tried to : match => [ "[start][timestamp][time]", "EEE, dd MM yyyy hh:mm:ss ZZZ" ] Still no luck. Any help would be welcome. Cheers, ...