failure field should by _@timestamp