diff --git a/filebeat/module/icinga/startup/test/test.log-expected.json b/filebeat/module/icinga/startup/test/test.log-expected.json
index ccc9670681db..f793fea6f9c5 100644
--- a/filebeat/module/icinga/startup/test/test.log-expected.json
+++ b/filebeat/module/icinga/startup/test/test.log-expected.json
@@ -1,6 +1,5 @@
 [
     {
-        "@timestamp": "2018-11-06T18:29:13.579Z", 
         "event.dataset": "startup", 
         "event.module": "icinga", 
         "icinga.startup.facility": "cli", 
@@ -10,7 +9,6 @@
         "log.offset": 0
     }, 
     {
-        "@timestamp": "2018-11-06T18:29:13.579Z", 
         "event.dataset": "startup", 
         "event.module": "icinga", 
         "icinga.startup.facility": "cli", 
diff --git a/filebeat/tests/system/test_modules.py b/filebeat/tests/system/test_modules.py
index 215d341ae4fe..8f54b152cb2e 100644
--- a/filebeat/tests/system/test_modules.py
+++ b/filebeat/tests/system/test_modules.py
@@ -159,6 +159,7 @@ def _test_expected_events(self, test_file, objects):
                 for k, obj in enumerate(objects):
                     objects[k] = self.flatten_object(obj, {}, "")
                     clean_keys(objects[k])
+
                 json.dump(objects, f, indent=4, sort_keys=True)
 
         with open(test_file + "-expected.json", "r") as f:
@@ -175,11 +176,6 @@ def _test_expected_events(self, test_file, objects):
                 obj = self.flatten_object(obj, {}, "")
                 clean_keys(obj)
 
-                # Remove timestamp for comparison where timestamp is not part of the log line
-                if obj["event.module"] == "icinga" and obj["event.dataset"] == "startup":
-                    delete_key(obj, "@timestamp")
-                    delete_key(ev, "@timestamp")
-
                 if ev == obj:
                     found = True
                     break
@@ -199,6 +195,10 @@ def clean_keys(obj):
     for key in host_keys + time_keys + other_keys:
         delete_key(obj, key)
 
+    # Remove timestamp for comparison where timestamp is not part of the log line
+    if obj["event.module"] == "icinga" and obj["event.dataset"] == "startup":
+        delete_key(obj, "@timestamp")
+
 
 def delete_key(obj, key):
     if key in obj: