One of a customer reported the following error when using the filebeat checkpoint module:
error.message: field [@timestamp] already exists

This seems to be related to how the ingest pipeline sets the timestamps, especially when the log contains a checkpoint.time field. Since none of the logs of test/checkpoint.log contains this field, the problem may not appear in the unit tests.

https://github.com/RealStuff/beats/tree/checkpoint-fix contains a fix for the problem.
Basically it renames the @timestamp field created by filebeat to event.created. In addition, rename processors were replaced by date processors to create the final @timestamp field.

Please let me know what you think about this fix. If you find it usable, I will create a pull request.

For confirmed bugs, please report:

• Version: 7.8
• Operating System: CentOS
• Discuss Forum URL:
• Steps to Reproduce: Send checkpoint log containing time field to filebeat checkpoint module.