Can I convert epoch time via data views to be readable?

Elastic Stack Kibana
1

good day,

my app log is in epoch time format (sample: 1700529701700), can I convert this using script in data views to be human readable format in discover menu? or any suggestion how to convert this?

i saw this in google, but I encountered "Cannot cast from [java.util.Date] to [void]. Verify that you have correctly set the runtime field type." error

cmd:
return new Date(Long.parseLong(doc["TXN_END.keyword"].value));

thank you very much

2

or idea on how to put this epoch time format in mappings / template?

3

Hi @geeboy1 welcome to the community!

Did you look at

There are examples on that page

4

hi @stephenb thank you :slight_smile:

is below template correct?

data views:
image

PUT _index_template/app1audit-template
{
  "index_patterns": ["app1audit*"],
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 0,
      "index.lifecycle.name": "180-days-default",      
      "index.lifecycle.rollover_alias": "app1audit-alias"    
    },
    "mappings": {
         "_source": {
            "enabled": true
      },
	    "properties" : {
        "TXN_START" : {
        "format" : "yyyy-MM-dd HH:mm:ss,SSS",  <--- is this correct? or what format should I put here?
        "type" : "date"
       }
     }
   }
 }
}
5

Perhaps this one

epoch_millis
A formatter for the number of milliseconds since the epoch. Note, that this timestamp is subject to the limits of a Java Long.MIN_VALUE and Long.MAX_VALUE.

Sooo

format" : "epoch_millis",

Or as it says right in the beginning of the docs I referred you to.

Date formats can be customised, but if no format is specified then it uses the default:

`"strict_date_optional_time||epoch_millis"`

So you could also just not specify a format or use that one....

6

thanks a lot for the explanation @stephenb :slight_smile: this one works!!

7

Which this one :wink:

Always good for others to show your solution...

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.