Based on the grok example from the docs, a Filebeat + Logstash stack will produce the following:

• a @timestamp field based on the time that filebeat sends the log to logstash, as timestamp type.
• a timestamp field from the Spring Boot log, as string type.

In order to use the Spring Boot timestamp as the real Logstash @timestamp I use the following filters after the grok pattern:

 date {
 match => ["timestamp", "ISO8601"]
 }
 mutate {
 remove_field => ["timestamp"]
 }

Using these filters will result in @timestamp being the Spring Boot's timestamp, as a timestamp type, and will remove the now duplicated (string type) timestamp.