How can I get the default `@timestamp` on elastic output?

steve.malenfant

Then, it shows up in the proper place: ```{"create":{"_index":"interfaces-sensors-ptx","pipeline":"remove_id","_id":"885zjZkprnmYaz69"}}```

steve.malenfant

I think this should be a little clearer: ```Elastic pipeline: To send data to an Elastic Ingest pipeline, optionally enter that pipeline's name as a constant.```

steve.malenfant

optionally should not be there. It should say JavaScript or quoted constant.

Harry Gardner

<@U03CJ90F91A&gt; :point_up:

azerbe

Sheesh, <@UUP82DJHE&gt;, nothing like calling me in at the end of a crazy long thread. But thanks for tagging me, I'll see if we can get that cleared up.

azerbe

Hi <@U0410L186KS&gt;, if you just want to add the new @timestamp field to the event, in place of _time... this is an easy way to create a field with special characters.

azerbe

`__e['@timestamp';]`

steve.malenfant

<@U02JJLAGJHF&gt; Thanks. I also see that "undefined". Learning the tricks

azerbe

then "undefined" just eliminates that other `_time` field from the event. Enjoy!!!

steve.malenfant

What is so special with `__e` ?

azerbe

Yep, steal the time from _time, throw it into a new custom field, then get rid of _time.

azerbe

__e allows you to create/reference fields with custom characters.

azerbe

Refer to this for more info: https://docs.cribl.io/stream/introduction-reference#special-chars

azerbe

Sometimes you will need to reference a field from a source that uses those "non standard" characters, etc. This way you can still use that data, or correct it, before moving on. OK? Good Luck <@U0410L186KS&gt;

steve.malenfant

Got it.