Closed jrask closed 8 years ago
.map ( ifNotExists('@timestamp').map( timestampFromMs('timestamp') )
Not valid, any custom fields would be in "message" and would have to be parsed after the event processor has been processed.