# 18 digit timestamp to ISO timings

**URL:** <https://discuss.elastic.co/t/18-digit-timestamp-to-iso-timings/183225>\
**Category:** Logstash\
**Created:** [May 29, 2019, 5:51am UTC](https://discuss.elastic.co/t/18-digit-timestamp-to-iso-timings/183225 "2019-05-29T05:51:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abinaya](https://avatars.discourse-cdn.com/v4/letter/a/b19c9b/32.png) [@Abinaya](https://discuss.elastic.co/u/Abinaya)\
**Post date:** [May 29, 2019, 5:51am UTC](https://discuss.elastic.co/t/18-digit-timestamp-to-iso-timings/183225/1 "2019-05-29T05:51:12Z")

</div>

Hi Team,

I have a 18 digit timestamp from a .NET error logs. I need to convert it to a readable date time format.

The parameter "DateTime" need to be changed to readable format using logstash

Sample log:

MESSAGE LoggerName = "ENG" DateTime = "636942060057511391" SessionId = "rgywn3e2mzkshrvqfze5avqi" MsgType = "ERROR"

Thanks & Regards  
Abinaya G

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 29, 2019, 12:55pm UTC](https://discuss.elastic.co/t/18-digit-timestamp-to-iso-timings/183225/2 "2019-05-29T12:55:26Z")

</div>

A .NET DateTime measures time in "100-nanosecond units called ticks. A particular date is the number of ticks since 12:00 midnight, January 1, 0001 A.D. (C.E.) in the GregorianCalendar calendar. The number excludes ticks that would be added by leap seconds."

There is no native support for that in logstash. You would have to write code in a ruby filter to do the conversion. Should be really simple code -- just figure out the number of 100-nanosecond ticks between 12:00 midnight, January 1, 0001 and the UNIX epoch, subtract that from your 18 digit number, then divide by 10,000 to get to milliseconds, then do a UNIXMS date conversion.

---

<div class="post-metadata">

**Author:** ![Abinaya](https://avatars.discourse-cdn.com/v4/letter/a/b19c9b/32.png) [@Abinaya](https://discuss.elastic.co/u/Abinaya)\
**Post date:** [May 30, 2019, 9:35am UTC](https://discuss.elastic.co/t/18-digit-timestamp-to-iso-timings/183225/3 "2019-05-30T09:35:31Z")

</div>

Thanks @Badger.

> [@Badger](#):
>
> 100-nanosecond ticks between 12:00 midnight, January 1, 0001 and the UNIX epoch

Can you please give more briefing me on the above quoted text with example.

Regards & Thanks,  
Abinaya G

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 27, 2019, 9:35am UTC](https://discuss.elastic.co/t/18-digit-timestamp-to-iso-timings/183225/4 "2019-06-27T09:35:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.