Change renaming @timestamp to copying values in Ingest pipelines (#29425)

kvch · mergify-bot · commit 67b6c65763e6 · 2021-12-17T15:28:42.000Z
(cherry picked from commit b52ad7f)
diff --git a/filebeat/module/nginx/ingress_controller/ingest/pipeline.yml b/filebeat/module/nginx/ingress_controller/ingest/pipeline.yml
@@ -208,9 +208,9 @@ processors:
       patterns:
         - ^%{IP:source.ip}$
       ignore_failure: true
-  - rename:
-      field: "@timestamp"
-      target_field: event.created
+  - set:
+      copy_from: "@timestamp"
+      field: event.created
   - date:
       field: nginx.ingress_controller.time
       target_field: "@timestamp"
diff --git a/x-pack/filebeat/module/checkpoint/firewall/ingest/pipeline.yml b/x-pack/filebeat/module/checkpoint/firewall/ingest/pipeline.yml
@@ -40,10 +40,9 @@ processors:
     - message
     - host
     ignore_missing: true
-- rename:
-    field: "@timestamp"
-    target_field: "event.created"
-    ignore_missing: true
+- set:
+    copy_from: "@timestamp"
+    field: "event.created"
 - date:
     field: "syslog5424_ts"
     formats: ["ISO8601", "UNIX"]
