Can I convert epoch time via data views to be readable?

[geeboy1 (Geeboy)]

good day,

my app log is in epoch time format (sample: 1700529701700), can I convert this using script in data views to be human readable format in discover menu? or any suggestion how to convert this?

i saw this in google, but I encountered "Cannot cast from [java.util.Date] to [void]. Verify that you have correctly set the runtime field type." error

cmd:
return new Date(Long.parseLong(doc["TXN_END.keyword"].value));

thank you very much

[geeboy1 (Geeboy)]

or idea on how to put this epoch time format in mappings / template?

[stephenb (Stephen Brown)]

Hi @geeboy1 welcome to the community!

Did you look at

Date field type | Elasticsearch Guide [8.11] | Elastic

There are examples on that page

[geeboy1 (Geeboy)]

hi @stephenb thank you

is below template correct?

data views:

PUT _index_template/app1audit-template
{
  "index_patterns": ["app1audit*"],
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 0,
      "index.lifecycle.name": "180-days-default",      
      "index.lifecycle.rollover_alias": "app1audit-alias"    
    },
    "mappings": {
         "_source": {
            "enabled": true
      },
	    "properties" : {
        "TXN_START" : {
        "format" : "yyyy-MM-dd HH:mm:ss,SSS",  <--- is this correct? or what format should I put here?
        "type" : "date"
       }
     }
   }
 }
}

[stephenb (Stephen Brown)]

Perhaps this one

epoch_millis
A formatter for the number of milliseconds since the epoch. Note, that this timestamp is subject to the limits of a Java Long.MIN_VALUE and Long.MAX_VALUE.

Sooo

format" : "epoch_millis",

Or as it says right in the beginning of the docs I referred you to.

Date formats can be customised, but if no format is specified then it uses the default:

`"strict_date_optional_time||epoch_millis"`

So you could also just not specify a format or use that one....

[geeboy1 (Geeboy)]

thanks a lot for the explanation @stephenb this one works!!

[stephenb (Stephen Brown)]

@geeboy1

this one works!!

Which this one

Always good for others to show your solution...