# Convert @timestamp to epoch

**URL:** <https://discuss.elastic.co/t/convert-timestamp-to-epoch/64522>\
**Category:** Logstash\
**Created:** [November 1, 2016, 7:55am UTC](https://discuss.elastic.co/t/convert-timestamp-to-epoch/64522 "2016-11-01T07:55:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rivaanbechan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rivaanbechan/32/12900_2.png) [@rivaanbechan](https://discuss.elastic.co/u/rivaanbechan)\
**Post date:** [November 1, 2016, 7:55am UTC](https://discuss.elastic.co/t/convert-timestamp-to-epoch/64522/1 "2016-11-01T07:55:02Z")

</div>

Hi,

I need to convert **@timestamp** to **epoch** and add this new field to the event.

So far I can only add a new field with the content of "@timestamp".

```
filter {
    mutate
    {
        add_field => ["epochtime", "%{@timestamp}"]
    }
}

```

I'm sure this will be an easy fix although I can't find anything to lead me to my answer.

Please assist.

Thank you,  
Rivaan

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [November 2, 2016, 10:28am UTC](https://discuss.elastic.co/t/convert-timestamp-to-epoch/64522/2 "2016-11-02T10:28:28Z")

</div>

you can use the ruby filter for this:

```auto
input { generator { count => 1 } }
filter {
  # for logstash 5.x
  ruby { code => "event.set('epoc', event.get('@timestamp').to_i)" }
  # for logstash 2.x
  # ruby { code => "event['epoc'] = event['@timestamp'].to_i" }
}
output { stdout { codec => rubydebug } }

```

```auto
{
          "epoc" => 1478082411,
      "sequence" => 0,
    "@timestamp" => 2016-11-02T10:26:51.303Z,
      "@version" => "1",
          "host" => "Joaos-MBP-5.lan",
       "message" => "Hello world!"
}

```

---

<div class="post-metadata">

**Author:** ![rivaanbechan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rivaanbechan/32/12900_2.png) [@rivaanbechan](https://discuss.elastic.co/u/rivaanbechan)\
**Post date:** [November 2, 2016, 1:42pm UTC](https://discuss.elastic.co/t/convert-timestamp-to-epoch/64522/3 "2016-11-02T13:42:36Z")

</div>

Hi @jsvd,

This works!! Thank you so much! 😄

Is it possible to also convert this to my timezone?

Thank you so much! 🙂  
Rivaan

---

<div class="post-metadata">

**Author:** ![rivaanbechan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rivaanbechan/32/12900_2.png) [@rivaanbechan](https://discuss.elastic.co/u/rivaanbechan)\
**Post date:** [November 3, 2016, 11:35am UTC](https://discuss.elastic.co/t/convert-timestamp-to-epoch/64522/4 "2016-11-03T11:35:09Z")

</div>

@jsvd,

I've figure out a method to push it into my timezone.

`# ruby { code => "event['epoc'] = event['@timestamp'].to_i + 7200" }`

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![Guare](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guare/32/14807_2.png) [@Guare](https://discuss.elastic.co/u/Guare)\
**Post date:** [February 20, 2017, 1:34pm UTC](https://discuss.elastic.co/t/convert-timestamp-to-epoch/64522/5 "2017-02-20T13:34:41Z")

</div>

hi!!

do you can tell me how i can use this in this case?

`1487596174.308 3 10.241.252.78 TCP_DENIED/407 1554 GET http://adrta.com/i? - NONE/- text/html`  
_(access log of squid)_  
`grok { match => ["message", "%{NOTSPACE:fecha}\s+%{NUMBER:respuestaMS} %{IPV4:ip_user} %{WORD:estado}/%{NUMBER:codigo_http} %{NUMBER:respuestaKB} %{WORD:metodo} %{NOTSPACE:url} %{DATA:user} %{DATA:estado}/%{DATA:ip_srv} %{GREEDYDATA:tipo}"] }`

But I'm missing the date conversion epoch to @timestamp

I have all parsed but I'm missing the date conversion epoch to @timestamp

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/convert-timestamp-to-epoch/64522/6 "2017-07-06T04:28:25Z")

</div>