filebeat @timestamp not overwritten
The problem was the format of the timestamp that log4j
is producing.Filebeat expects something of the form "2017-04-11T09:38:33.365Z"
it has to have to T
in the middle the Z
in the end and dot instead of comma before the milliseconds.
Quickest (and somewhat dirty) way I found to do that was by using the following pattern
pattern='{"@timestamp": "%d{YYYY-MM-dd}T%d{HH:mm:ss.SSS}Z"}
A similar issue can be found here. The suggested solution does not solve the filebeat issue though because it uses comma!