Convert Ticks to @timestamp in logstash with Ruby-plugin

Elastic Stack Logstash
1

I query every minute against a MSSQL Database with jdbc-plugin.
In this Database my timestamp is stored in ticks. Field-name is lastupdate.
Now I wanted to convert the lastupdate field to a timestamp-format and then overwrite the @timestamp field with the converted lastvalue field.
I tried the ruby filter-plugin, but couldn't achieve the conversion and instead got _rubyexception and _dateparsefailure.

My filter looks like this:

filter {
  if [type] == "mydb" {
    ruby {
      init => "require 'time'"
      code => "lastupdate = Time.at(event['lastupdate'].to_s)"
    }
    date {
      match => [ "lastupdate", "MM/dd/YY HH:mm:ss,SSS" ]
    }
  }
}

Thanks in advance!
Chris

2

Solution:

http://stackoverflow.com/questions/39039357/convert-ticks-to-timestamp-in-logstash-with-ruby-plugin

filter {
  if [type] == "mydb" {
    ruby {
      code => "event['@timestamp'] = LogStash::Timestamp.at((event['lastupdate'].to_i - 621355968000000000) / 10_000_000.0)"
    }
  }
}
3

Thanks for sharing the solution :slight_smile:

4

Ticks is milliseconds since 1970-01-01, no? If so the date filter's UNIX_MS pattern should be usable out of the box.

5

The value of this property represents the number of 100-nanosecond intervals that have elapsed since 12:00:00 midnight, January 1, 0001 (0:00:00 UTC on January 1, 0001, in the Gregorian calendar).