18 digit timestamp to ISO timings

Hi Team,

I have a 18 digit timestamp from a .NET error logs. I need to convert it to a readable date time format.

The parameter "DateTime" need to be changed to readable format using logstash

Sample log:

MESSAGE LoggerName = "ENG" DateTime = "636942060057511391" SessionId = "rgywn3e2mzkshrvqfze5avqi" MsgType = "ERROR"

Thanks & Regards
Abinaya G

A .NET DateTime measures time in "100-nanosecond units called ticks. A particular date is the number of ticks since 12:00 midnight, January 1, 0001 A.D. (C.E.) in the GregorianCalendar calendar. The number excludes ticks that would be added by leap seconds."

There is no native support for that in logstash. You would have to write code in a ruby filter to do the conversion. Should be really simple code -- just figure out the number of 100-nanosecond ticks between 12:00 midnight, January 1, 0001 and the UNIX epoch, subtract that from your 18 digit number, then divide by 10,000 to get to milliseconds, then do a UNIXMS date conversion.

Thanks @Badger.

Can you please give more briefing me on the above quoted text with example.

Regards & Thanks,
Abinaya G

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.