Create a new field (customdate) like yyyy-mm(2020-08) format from eventstamp(1597739955692) type Epoch

I want to create a new field with a year-month format (yyyy-mm, 2020-08) from the eventstamp field which I am receiving in Epoch format. I am new to logstash, I was able to add a new field but I don't know how to covert the epoch to custom date format.

 add_field => {
            "customdate" => "%{timestamp}"
        }

Appreciate your help in advance. Thank you.

I would do that using

    date { match => [ "eventstamp", "UNIX_MS" ] target => "[@metadata][timestamp]" }
    ruby { code => ' event.set("customdate", Time.at(event.get("[@metadata][timestamp]").to_f).strftime("%Y/%m")) ' }

@Badger Thanks, it worked and I was able to convert the date format as well.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.