filebeat @timestamp not overwritten filebeat @timestamp not overwritten json json

filebeat @timestamp not overwritten


The problem was the format of the timestamp that log4j is producing.Filebeat expects something of the form "2017-04-11T09:38:33.365Z" it has to have to T in the middle the Z in the end and dot instead of comma before the milliseconds.

Quickest (and somewhat dirty) way I found to do that was by using the following pattern

pattern='{"@timestamp": "%d{YYYY-MM-dd}T%d{HH:mm:ss.SSS}Z"}

A similar issue can be found here. The suggested solution does not solve the filebeat issue though because it uses comma!