Description of problem:

After configuring prune filter as per documentation, the _timestamp field doesn't persist in RHOL 6.3.1 version, until the prune filter is reconfigured to use ".timestamp" instead of ."@timestamp" (referenced in documentation).

Version-Release number of selected component (if applicable):

Red Hat OpenShift Logging 6.3.1

How reproducible:

100%

Steps to Reproduce:

1. Install and configure RHOL 6.3 with LokiStack
2. Implement prune filter to omit the fields using documentation
3. After the vector pods are restarted, then expand any log record in "Observe > Logs" menu and notice that "_timestamp" is missing from there.

YAML of ClusterLogForwarder:

apiVersion: observability.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  creationTimestamp: "2025-09-24T12:06:19Z"
  generation: 4
  name: collector
  namespace: openshift-logging
  resourceVersion: "680788"
  uid: 9851f7e7-c3c7-4b25-84ff-298de39a99cd
spec:
  filters:
  - name: prune-filter
    prune:
      notIn:
      - .log_type
      - .message
      - ."@timestamp"       <<<<==== Doesn't work in Logging 6.3
      - .log_source
    type: prune
  managementState: Managed
  outputs:
  - lokiStack:
      authentication:
        token:
          from: serviceAccount
      target:
        name: logging-loki
        namespace: openshift-logging
    name: default-lokistack
    tls:
      ca:
        configMapName: openshift-service-ca.crt
        key: service-ca.crt
    type: lokiStack
  pipelines:
  - filterRefs:
    - prune-filter
    inputRefs:
    - application
    - infrastructure
    name: default-logstore
    outputRefs:
    - default-lokistack
  serviceAccount:
    name: collector 

Same ClusterLogForwarder works fine in RHOL 6.2.5 and keeps the _timestamp field

Actual results:

After implementing prune filter to keep ."@timestamp" then it still removes the field from the log record.

Expected results:

The timestamp field should persist on the log record when prune filter is configured to keep ."@timestamp"

Additional info:

The config is working fine in Red Hat OpenShift Logging 6.2.5 version. The timestamp was seen under "_timestamp" field in RHOL 6.2.5
Additionally, when .timestamp (instead of ."@timestamp") is defined in notIn section, then it works fine in RHOL 6.3.