# Convert epoch milli to datetime

**URL:** <https://discuss.elastic.co/t/convert-epoch-milli-to-datetime/157656>\
**Category:** Logstash\
**Created:** [November 21, 2018, 8:44am UTC](https://discuss.elastic.co/t/convert-epoch-milli-to-datetime/157656 "2018-11-21T08:44:13Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sumitbiswas](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@sumitbiswas](https://discuss.elastic.co/u/sumitbiswas)\
**Post date:** [November 21, 2018, 8:44am UTC](https://discuss.elastic.co/t/convert-epoch-milli-to-datetime/157656/1 "2018-11-21T08:44:13Z")

</div>

Logstash version: 6.5.0

How do we convert epoch millisecond to datetime? Thanks in advance.

Below parses data and in Kibana is seen as below which is wrong.

(t) epoch\_time: 1542765548000000000  
(t) myTime: 48890264-01-11T11:33:20.000Z

**Input log content as below**

```
value=9663.8 1542765548000000000
value=9736.7 1542765548000000000
value=10453.89 1542765548000000000

```

**logstash config file**

```
filter {
    grok {
        match => { "message" => "value=%{BASE10NUM:cpu_value}\ %{PROG:epoch_time}"}
    }
    date {
        match => ["epoch_time","UNIX_MS"]
        target => "myTime"
    }
}
```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 21, 2018, 8:49am UTC](https://discuss.elastic.co/t/convert-epoch-milli-to-datetime/157656/2 "2018-11-21T08:49:30Z")

</div>

That looks like nanoseconds and not milliseconds. Drop the last 6 digits and I think you should get the expected timestamp with that date filter.

---

<div class="post-metadata">

**Author:** ![sumitbiswas](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@sumitbiswas](https://discuss.elastic.co/u/sumitbiswas)\
**Post date:** [November 21, 2018, 12:04pm UTC](https://discuss.elastic.co/t/convert-epoch-milli-to-datetime/157656/3 "2018-11-21T12:04:45Z")

</div>

Hi Christian,

Thanks for the suggestion. Can you please suggest how do we remove last 6 digits?

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 21, 2018, 12:20pm UTC](https://discuss.elastic.co/t/convert-epoch-milli-to-datetime/157656/4 "2018-11-21T12:20:17Z")

</div>

The obvious way would be to divide by 1000000.

You could do this using a ruby filter first:

```
ruby {
                            code => "event.set('epoch_time_convert', event.get('epoch_time') / 1000000)"
}

```

Which will give you a field epoch\_time\_convert: 1542765548000

Then do:

```
date {
    match => ["epoch_time_convert","UNIX_MS"]
    target => "myTime"
}
```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 21, 2018, 12:35pm UTC](https://discuss.elastic.co/t/convert-epoch-milli-to-datetime/157656/5 "2018-11-21T12:35:16Z")

</div>

The easiest way would probably be to change your grok pattern to capture the last 6 digits separately.

---

<div class="post-metadata">

**Author:** ![sumitbiswas](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@sumitbiswas](https://discuss.elastic.co/u/sumitbiswas)\
**Post date:** [November 21, 2018, 1:24pm UTC](https://discuss.elastic.co/t/convert-epoch-milli-to-datetime/157656/6 "2018-11-21T13:24:07Z")

</div>

Thanks Eniqmatic and Christian for your suggestions. It solved the problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 19, 2018, 1:24pm UTC](https://discuss.elastic.co/t/convert-epoch-milli-to-datetime/157656/7 "2018-12-19T13:24:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.