CSV EPOCH to Timestamp


I have a csv file with contents similar to this:


This first line are the column names. The TIME column is the EPOCH time of the record retrieval. I'm able to ingest it into Elastic via Logstash but I want the @timestamp to be the time in the TIME column.

My filter is as follows:

filter {
csv {
separator => ","
columns => [ "UNIT_ID" , "Serial_Number" , "Query Date" ]

    date {
            match => [ "TIME" , "UNIX" ]


When I ingest it now they all have the same @timestamp. What am I missing?


You renamed the TIME column to field [Query Date] using the columns option of your csv filter.


Sure did. Replacing it with TIME fixed the problem. Thanks again Badger.