# Convert my doc.timestamp as date

**URL:** https://discuss.elastic.co/t/convert-my-doc-timestamp-as-date/314973
**Category:** Logstash
**Created:** [September 22, 2022, 8:28pm UTC](https://discuss.elastic.co/t/convert-my-doc-timestamp-as-date/314973 "2022-09-22T20:28:35Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![erwin339](https://avatars.discourse-cdn.com/v4/letter/e/2bfe46/32.png) [@erwin339](https://discuss.elastic.co/u/erwin339)
#### Post date: [September 22, 2022, 8:28pm UTC](https://discuss.elastic.co/t/convert-my-doc-timestamp-as-date/314973/1 "2022-09-22T20:28:35Z")

</div>

I am currently trying to get the date the logs were generated since I only have the date they were processed, I am receiving the logs in log4j xml format. I am unable to convert the UNIX date to this format Sep 22, 2022 @ 14:00:11.475.  
This in order to use the creation date of the logs and use it when creating a data view.

MI LOG:

```auto
<log4j:event logger="LogGeneratorApp.MainForm" timestamp="1663101248196" level="INFO" thread="1"><log4j:message>This is a test log message</log4j:message><log4j:properties><log4j:data name="log4net:UserName" value="TENARIS\60085367" /><log4j:data name="log4jmachinename" value="TAMP00043541" /><log4j:data name="log4japp" value="LogGeneratorApp.exe" /><log4j:data name="log4net:HostName" value="TAMP00043541" /></log4j:properties><log4j:locationInfo class="LogGeneratorApp.MainForm" method="SendToLog" file="" line="0" /></log4j:event>

```

MI LOGSTASH:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/1/11e58685ec2dc402cf82635f1c693f5ea41398f9.png)

log creation date  
I NEED TO CONVERT THIS:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/4/24561d63fc09b7d673f546b8eeca1f5747b23fad.png)

log processing date  
TO THIS:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/f/3f77caa4708409e560ddeedea7aec928dfcd1acb.png)

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [September 22, 2022, 8:42pm UTC](https://discuss.elastic.co/t/convert-my-doc-timestamp-as-date/314973/2 "2022-09-22T20:42:12Z")

</div>

You do that with the `date` filter that you commented in your configuration, but you need to use the correct field.

From what you shared it needs to be `[doc][timestamp]` no `timestamp`.

---

<div class="post-metadata">

### Author: ![erwin339](https://avatars.discourse-cdn.com/v4/letter/e/2bfe46/32.png) [@erwin339](https://discuss.elastic.co/u/erwin339)
#### Post date: [September 22, 2022, 8:52pm UTC](https://discuss.elastic.co/t/convert-my-doc-timestamp-as-date/314973/3 "2022-09-22T20:52:59Z")

</div>

> [@leandrojmp](#):
>
> `[doc][timestamp]` `timestamp`

Yes, I was doing tests and decided to comment on it because I didn't know if the format was correct.  
This is correct?

![image](https://us1.discourse-cdn.com/elastic/original/3X/7/8/7847bc471b949535239d295c026f3c4f1cd7ff5d.png)

It is not working for me as I show it in the image.

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [September 22, 2022, 9:08pm UTC](https://discuss.elastic.co/t/convert-my-doc-timestamp-as-date/314973/4 "2022-09-22T21:08:07Z")

</div>

It needs to be `UNIX_MS`

You can use:

`match => ["[doc][timestamp]", "UNIX", "UNIX_MS"]`

This will test against both `UNIX` and `UNIX_MS`.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 20, 2022, 9:09pm UTC](https://discuss.elastic.co/t/convert-my-doc-timestamp-as-date/314973/5 "2022-10-20T21:09:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.