Use actual log timestamp as logstash timestamp

[rafaelrenanpacheco]

Based on the grok example from the docs, a Filebeat + Logstash stack will produce the following:

• a @timestamp field based on the time that filebeat sends the log to logstash, as timestamp type.
• a timestamp field from the Spring Boot log, as string type.

In order to use the Spring Boot timestamp as the real Logstash @timestamp I use the following filters after the grok pattern:

  date {
    match => ["timestamp", "ISO8601"]
  }
  mutate {
    remove_field => ["timestamp"]
  }

Using these filters will result in @timestamp being the Spring Boot's timestamp, as a timestamp type, and will remove the now duplicated (string type) timestamp.

[codecov]

Codecov Report

Merging #1522 into master will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff            @@
##             master    #1522   +/-   ##
=========================================
  Coverage     59.67%   59.67%           
  Complexity      845      845           
=========================================
  Files           159      159           
  Lines          4617     4617           
  Branches        514      514           
=========================================
  Hits           2755     2755           
  Misses         1626     1626           
  Partials        236      236

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b93e739...1a98c2b. Read the comment docs.

[marcingrzejszczak]

Very good point, thanks!