Related GitHub issues and PR:

• Cloudflare Logpush - http_request ingest pipeline does not set @Timestamp #5571
• cloudflare_logpush: use EdgeStartTimestamp event timestamp #5599

Issue: The @timestamp field for docs ingested from Logpush to Elasticsearch is pulled from EdgeStartTimestamp and the pipeline processor is defined to accept any of the following formats:

However, per the Logpull documentation, the available formats that can be configured are as follows:

timestamp_format: string to specify format for timestamps, such as unixnano, unix, or rfc3339. Default unixnano. 

As a result, if the data comes through as UNIX for example (seconds from 1970) it would be interpreted as a UNIX_MS timestamp (milliseconds from 1970) resulting in a completely inaccurate timestamp.

Possible workarounds may include:

• Refactoring the Elasticsearch pipeline processor to use the given format.
• Reconfiguring the log output options in Cloudflare to accommodate the values are accepted by the pipeline (not recommended).