Timestamp override

[lingster]

Added option to specify timestamp from field in event.
use the timestamp_override field to define the field to use when specifying a timestamp instead of using the timestamp of the event. Useful if parsing historical log files.

[lingster]

Apologises I noticed in the diff that my editor appears to have changed the quotes from ` to ' I can revert this change if it's an annoyance.

[electrical]

Would it make more sense to have a config option called timestamp_field and default it to the @timestamp field?
This avoid any extra conditionals like you have now.

[lingster]

ah yes - that's a splendid idea....I'll look into it!

[purbon]

Thanks a lot for your contribution @lingster , in order to move forward with your PR is going to be necessary to sign the CLA agreement, you can find more information at https://www.elastic.co/contributor-agreement.

On the other side, it would be super nice if you can add test for this change. We try to enforce that all PR introduce some kind of testing, so we're able to increase the overall quality. Don't hesitate to ask any question regarding you might have, more than looking forward to help.

Looking forward to get this in,

• purbon

[elasticsearch-release]

Jenkins standing by to test this. If you aren't a maintainer, you can ignore this comment. Someone with commit access, please review this and clear it for Jenkins to run; then say 'jenkins, test it'.

[purbon]

Opened #19 because of the long stalled CLA request not fulfilled, more than welcome to reopen and get this merged if the CLA gets signed.
Thanks a lot for your time.