Convert my doc.timestamp as date

Elastic Stack Logstash
#1

I am currently trying to get the date the logs were generated since I only have the date they were processed, I am receiving the logs in log4j xml format. I am unable to convert the UNIX date to this format Sep 22, 2022 @ 14:00:11.475.
This in order to use the creation date of the logs and use it when creating a data view.

MI LOG:

<log4j:event logger="LogGeneratorApp.MainForm" timestamp="1663101248196" level="INFO" thread="1"><log4j:message>This is a test log message</log4j:message><log4j:properties><log4j:data name="log4net:UserName" value="TENARIS\60085367" /><log4j:data name="log4jmachinename" value="TAMP00043541" /><log4j:data name="log4japp" value="LogGeneratorApp.exe" /><log4j:data name="log4net:HostName" value="TAMP00043541" /></log4j:properties><log4j:locationInfo class="LogGeneratorApp.MainForm" method="SendToLog" file="" line="0" /></log4j:event>

MI LOGSTASH:

image
image955×596 16.7 KB

log creation date
I NEED TO CONVERT THIS:
image

log processing date
TO THIS:
image

#2

You do that with the date filter that you commented in your configuration, but you need to use the correct field.

From what you shared it needs to be [doc][timestamp] no timestamp.

#3

Yes, I was doing tests and decided to comment on it because I didn't know if the format was correct.
This is correct?

image

It is not working for me as I show it in the image.

#4

It needs to be UNIX_MS

You can use:

match => ["[doc][timestamp]", "UNIX", "UNIX_MS"]

This will test against both UNIX and UNIX_MS.

1 Like