Timestamps in Elastic data

[regulartim]

Hi! :) I am currently working on GreedyBear and have a question regarding timestamps in the Elastic data. It seems to me that every honeypot interaction has an @timestamp field that is not NULL. Is this assumption correct? If so, can you tell me since which version of T-Pot this is the case?

[t3chn0m4g3]

Awesome to hear GreedyBear development continues!

T-Pot events are always time based events, so there are the fields @timestamp and timestamp which should never be NULL, but contain a UTC derived timestamp.

[regulartim]

And it always has been like that?

[t3chn0m4g3]

I sure hope so, otherwise the time series based visualizations in Kibana would not work 😅
But this is a really deep stroll into the ELK woods, so no guarantees to the all-mighty-breaking-changes 😇

[regulartim]

Alright, thank you! :)