{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/beats/issues/1831","repository_url":"https://api.github.com/repos/elastic/beats","labels_url":"https://api.github.com/repos/elastic/beats/issues/1831/labels{/name}","comments_url":"https://api.github.com/repos/elastic/beats/issues/1831/comments","events_url":"https://api.github.com/repos/elastic/beats/issues/1831/events","html_url":"https://github.com/elastic/beats/pull/1831","id":159611912,"number":1831,"title":"filebeat: Add failing tests for @timestamps in JSON with timezone specified","user":{"login":"morganchristiansson","id":66844,"avatar_url":"https://avatars.githubusercontent.com/u/66844?v=3","gravatar_id":"","url":"https://api.github.com/users/morganchristiansson","html_url":"https://github.com/morganchristiansson","followers_url":"https://api.github.com/users/morganchristiansson/followers","following_url":"https://api.github.com/users/morganchristiansson/following{/other_user}","gists_url":"https://api.github.com/users/morganchristiansson/gists{/gist_id}","starred_url":"https://api.github.com/users/morganchristiansson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/morganchristiansson/subscriptions","organizations_url":"https://api.github.com/users/morganchristiansson/orgs","repos_url":"https://api.github.com/users/morganchristiansson/repos","events_url":"https://api.github.com/users/morganchristiansson/events{/privacy}","received_events_url":"https://api.github.com/users/morganchristiansson/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/beats/labels/enhancement","name":"enhancement","color":"fbca04"},{"url":"https://api.github.com/repos/elastic/beats/labels/Filebeat","name":"Filebeat","color":"008000"},{"url":"https://api.github.com/repos/elastic/beats/labels/needs%20CLA","name":"needs CLA","color":"cc317c"},{"url":"https://api.github.com/repos/elastic/beats/labels/Pioneer%20Program","name":"Pioneer Program","color":"b60205"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":15,"created_at":"2016-06-10T11:08:11Z","updated_at":"2016-06-27T10:51:14Z","closed_at":"2016-06-20T21:12:01Z","pull_request":{"url":"https://api.github.com/repos/elastic/beats/pulls/1831","html_url":"https://github.com/elastic/beats/pull/1831","diff_url":"https://github.com/elastic/beats/pull/1831.diff","patch_url":"https://github.com/elastic/beats/pull/1831.patch"},"body":"filebeat is currently generating errors for timestamps with timezone specified as +00:00 ('Z' is allowed without suffix). Failing tests added.\r\n\r\nThis is the default @timestamp format used by kibana json log for example.\r\n\r\nSeems to have been introduced here: https://github.com/elastic/beats/pull/1421/files#r60245935"},"comment":{"url":"https://api.github.com/repos/elastic/beats/issues/comments/228713620","html_url":"https://github.com/elastic/beats/pull/1831#issuecomment-228713620","issue_url":"https://api.github.com/repos/elastic/beats/issues/1831","id":228713620,"user":{"login":"morganchristiansson","id":66844,"avatar_url":"https://avatars.githubusercontent.com/u/66844?v=3","gravatar_id":"","url":"https://api.github.com/users/morganchristiansson","html_url":"https://github.com/morganchristiansson","followers_url":"https://api.github.com/users/morganchristiansson/followers","following_url":"https://api.github.com/users/morganchristiansson/following{/other_user}","gists_url":"https://api.github.com/users/morganchristiansson/gists{/gist_id}","starred_url":"https://api.github.com/users/morganchristiansson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/morganchristiansson/subscriptions","organizations_url":"https://api.github.com/users/morganchristiansson/orgs","repos_url":"https://api.github.com/users/morganchristiansson/repos","events_url":"https://api.github.com/users/morganchristiansson/events{/privacy}","received_events_url":"https://api.github.com/users/morganchristiansson/received_events","type":"User","site_admin":false},"created_at":"2016-06-27T10:51:14Z","updated_at":"2016-06-27T10:51:14Z","body":"I've implemented this workaround/solution to fix the events in logstash after they've exited the filebeats pipeline.\r\n\r\n```\r\nfilter {\r\n  if [json] {\r\n    ruby {\r\n      code => \"event['json'].each { |k,v| event[k]=v } ; event.remove('json')\"\r\n    }\r\n  }\r\n}\r\n```\r\n\r\nand then set ```filebeat.prospectors[].json.keys_under_root: false``` everywhere."}}
{"actor":{"display_login":"morganchristiansson"}}