Extract timestamp from JSON and use it as the logstash event timestamp Extract timestamp from JSON and use it as the logstash event timestamp json json

Extract timestamp from JSON and use it as the logstash event timestamp


I think you may have misunderstood how the date filter (there don't appear to be docs for 1.3.1) works, it takes a field, and parses it against a pattern you set and uses that match to set the value of the @timestamp field (by default). Since you are taking the @timestamp field, matching it against a pattern and then trying to set the @timestamp field with it, what you're doing is redundant.

If you have a different timestamp field you want to take the date from I expect it would probably work, as long as you were using the right pattern for that field.

I would also recommend you update to 1.4.2 as the older version you are running might be buggy.