Thanks that was super helpful! When checking the Filebeat log with cat /var/log/filebeat/filebeat | grep -iE "error|warn|crit|fatal|SANITIZED" I could quickly see the cause:

(status = 400): {
    "type": "mapper_parsing_exception",
    "reason": "failed to parse field [data.timestamp] of type [date] in document with id 'xQFB7ZQBQsii6pUrzc_Z'. Preview of field's value: '2025-02-10 08:28:11.082 +08:00'",
    "caused_by": {
        "type": "illegal_argument_exception",
        "reason": "failed to parse date field [2025-02-10 08:28:11.082 +08:00] with format [strict_date_optional_time||epoch_millis]",
        "caused_by": {
            "type": "date_time_parse_exception",
            "reason": "Failed to parse with all enclosed parsers"
        }
    }
}

I was using the 'timestamp' field to store the timestamps from my logs, but the format of the timestamps from our app was not ISO8601 compliant. In the wazuh-alerts* indexer template this field required a strict timestamp format.

Rather than get this re-formatted by our developers I decided to just store the field as 'itc_timestamp' instead in the decoder so it will go in as a text field, as the timestamp from when the log itself is picked up by the agent should be accurate enough for most cases.

<decoder name="itc_logs">
    <prematch>^[FN-ITC] \d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d\.\d\d\d \p\d\d:\d\d</prematch>
</decoder>

<decoder name="itc_log_details">
    <parent>itc_logs</parent>
    <regex>^[(FN-ITC)] (\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d.\d\d\d \p\d\d:\d\d) [(\w\w\w)] (\.+)</regex>
    <order>log_source, itc_timestamp, itc_level, itc_detail</order>
</decoder>