<p>I am writing out json structured log messages to stdout with exactly one time field, called <code>origin_timestamp</code>. </p>

<p>I collect the log messages using Fluent Bit with the tail input plugin, which uses the parser <code>docker</code>. The parser is configured with the <code>Time_Key time</code>. </p>

<p>The documentation about <code>Time_Key</code> says:</p>

<blockquote>
  <p>If the log entry provides a field with a timestamp, this option
  specify the name of that field.</p>
</blockquote>

<p>Since <code>time</code> != <code>origin_timestamp</code>, I would have thought no time fields will be added by Fluent Bit, however the final log messages ending up in Elasticsearch have the following time fields:</p>

<ul>
<li>(<code>origin_timestamp</code> within the field log that contains the original log message)</li>
<li><code>origin_timestamp</code></li>
<li><code>time</code></li>
<li><code>@timestamp</code> (sometimes even multiple times).</li>
</ul>

<p>The <code>@timestamp</code> field is probably added by the es output plugin I am using in Fluent Bit, but <strong>where the heck is the <code>time</code> field coming from?</strong> </p>

DaveFar
<p>I came across the following issue in the Fluent-bit issue tracker, <a href="https://github.com/fluent/fluent-bit/issues/628#issuecomment-518316428" rel="nofollow noreferrer">Duplicate @timestamp fields in elasticsearch output</a>, which sounds like it might be related to your issue in question.</p>

<p>I've deep linked to a particular comment from one of the contributors, which outlines two possible solutions depending on whether you are using their Kubernetes Filter plugin, or are ingesting the logs into Elasticsearch directly.</p>

<p>Hope this helps.</p>
