Renaming field data.Timestamp to data.timestamp

[Mithun Haridas]

Hi Team,

I have already added a prefix to my TeamViewer logs using the out_format feature to differentiate them from the default JSON decoder. This allows me to create custom decoders for fields that are not being parsed by the built-in JSON decoder.

However, I am facing another issue. The logs contain a field named Timestamp, which is currently being decoded by the JSON plugin as data.Timestamp. Since the value is already in a format compatible with Wazuh's timestamp field, I would like to map it to data.timestamp instead.

Is there any way to limit or customize the JSON plugin decoder so that I can override or rename this field and handle it separately through a custom decoder using the full log? Disabling the JSON decoder is not an option because it efficiently parses most of the TeamViewer log fields.

Has anyone encountered a similar situation, or is there a recommended approach to achieve this field mapping without losing the benefits of JSON decoding?


Full Log:
The highlighted portion is the out_format I added.

2026 Aug 12 06:10:04 /var/log/remote_logs/teamviewer/teamviewer_logs/teamviewer_audit.log teamviewer: teamviewer_tensor: {"EventDetails": [{"OldValue": "", "NewValue": "Remote Control", "PolicyEnforcementNewValue": null, "PolicyEnforcementOldValue": null, "PropertyName": "Session type", "PropertyCategory": "SessionInfo"}, {"OldValue": "", "NewValue": "Reconnect Token", "PolicyEnforcementNewValue": null, "PolicyEnforcementOldValue": null, "PropertyName": "Used Authentication Method", "PropertyCategory": "SessionInfo"}, {"OldValue": "", "NewValue": "000160050", "PolicyEnforcementNewValue": null, "PolicyEnforcementOldValue": null, "PropertyName": "ID of participant", "PropertyCategory": "SessionInfo"}, {"OldValue": "", "NewValue": "ABCD . AB", "PolicyEnforcementNewValue": null, "PolicyEnforcementOldValue": null, "PropertyName": "Name of participant", "PropertyCategory": "SessionInfo"}, {"OldValue": "", "NewValue": "116116111", "PolicyEnforcementNewValue": null, "PolicyEnforcementOldValue": null, "PropertyName": "ID of presenter", "PropertyCategory": "SessionInfo"}, {"OldValue": "", "NewValue": "XYZ", "PolicyEnforcementNewValue": null, "PolicyEnforcementOldValue": null, "PropertyName": "Name of presenter", "PropertyCategory": "SessionInfo"}], "EventName": "Ended session", "EventType": "Session", "Timestamp": "2026-08-12T06:05:44Z", "Author": "ABCD . AB", "AuthorEmail": "AB...@XYZ.com", "AffectedItem": "8anfjdng6e8-6333-4yyca-b44de-53dhfbj87a77"}

Thanks in advance for your help.

[Olamilekan Abdullateef Ajani]

Hello,

For the JSON_Decoder plugin you can't restrict which keys it parses, exclude fields, or rename them. Either you use or you dont. But you don't need to disable it. You can combine a plugin decoder with a regex sibling decoder under the same parent, and the fields from both get merged into the same event.

Key thing is that the siblings must share the same <name>, not just the same <parent>. If the names differ, analysisd stops after the first child that matches and never evaluates the second one.


<decoder name="teamviewer_event">
  <program_name>^teamviewer$</program_name>
</decoder>

<decoder name="teamviewer_event">
  <parent>teamviewer_event</parent>
  <prematch>teamviewer_tensor: </prematch>
  <plugin_decoder offset="after_prematch">JSON_Decoder</plugin_decoder>
</decoder>

<decoder name="teamviewer_event">
  <parent>teamviewer_event</parent>
  <regex type="pcre2">"Timestamp":\s*"([^"]+)"</regex>
  <order>event_time</order>
</decoder>

Tested with wazuh-logtest, and it returns all the JSON fields plus event_time: '2026-08-12T06:05:44Z'.

On naming it timestamp specifically, don't. timestamp is reserved by the pre-decoding phase (you can see it in Phase 1 holding the syslog header time), and <order> won't write to it. You can use event_time or similar. However, if something requires the path data.timestamp, you can just rename it in the Filebeat/indexer ingest pipeline instead:


{
  "rename": {
    "field": "data.event_time",
    "target_field": "data.timestamp",
    "if": "ctx.decoder?.name == 'teamviewer_tensor'",
    "ignore_missing": true
  }
}

Althouh, data.Timestamp remains alongside your new field

EventDetails isn't being parsed because Wazuh's JSON decoder doesn't support arrays of objects. You can use the same sibling technique extracts what you need.

<decoder name="teamviewer_tensor">
  <parent>teamviewer_tensor</parent>
  <regex type="pcre2">"NewValue":\s*"([^"]*)"[^}]*"PropertyName":\s*"ID of participant"</regex>
  <order>participant_id</order>
</decoder>

Please let me know if this helps.