A .NET DateTime measures time in "100-nanosecond units called ticks. A particular date is the number of ticks since 12:00 midnight, January 1, 0001 A.D. (C.E.) in the GregorianCalendar calendar. The number excludes ticks that would be added by leap seconds."
There is no native support for that in logstash. You would have to write code in a ruby filter to do the conversion. Should be really simple code -- just figure out the number of 100-nanosecond ticks between 12:00 midnight, January 1, 0001 and the UNIX epoch, subtract that from your 18 digit number, then divide by 10,000 to get to milliseconds, then do a UNIXMS date conversion.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.