Hi Cristian, Do you have Logstash in the mix (hence the need for @timestamp) or do you use rsyslog -> ES -> Kibana?
If it's the latter, I think you can change the "timestamping" from Kibana to whatever field contains a date. To do that (at least in version 3 or later), you'd go to the Dashboard settings on the upper-right, then go to Timepicker and change the "Time Field". For histogram panels, you also have a Time Field somewhere in the settings. Best regards, Radu -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/ On Tue, Aug 12, 2014 at 1:56 AM, Cristian Falcas <[email protected]> wrote: > Hello, > > I can't find any way to set a field with name "@timestamp" in a json > template. > > Did anyone managed to set fields with non-ascii names? > > My conf is something like this: > template(name="es_template" type="subtree" subtree="$!") > set $!timestamp = $timereported; > set $!timegenerated = %timegenerated; > > and I would like to set it to this: > set $!@timestamp = $timereported; > > > Best regards, > Cristian Falcas > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
