[Functionbeat] fix cloudwatch logs timestamp to use logRecord timesta…

…mp… (#13291)

… instead of record processing timestamp

The suggested TODO code passes the Cloudwatch timestamp as seconds. The Cloudwatch field value is milliseconds. Pass it as nanoseconds times 1000000.

Closes: #12412

CHANGELOG.next.asciidoc

@@ -192,6 +192,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 *Functionbeat*
 
 - Fix function name reference for Kinesis streams in CloudFormation templates {pull}11646[11646]
+- Fix Cloudwatch logs timestamp to use timestamp of the log record instead of when the record was processed {pull}13291[13291]
 
 ==== Added
 

x-pack/functionbeat/provider/aws/aws/transformer/transformer.go

@@ -24,7 +24,7 @@ func CloudwatchLogs(request events.CloudwatchLogsData) []beat.Event {
 
 	for idx, logEvent := range request.LogEvents {
 		events[idx] = beat.Event{
-			Timestamp: time.Now(), // TODO: time.Unix(logEvent.Timestamp, 0),
+			Timestamp: time.Unix(0, logEvent.Timestamp*1000000),
 			Fields: common.MapStr{
 				"message":              logEvent.Message,
 				"id":                   logEvent.ID,