CSV EPOCH to Timestamp

I have a csv file with contents similar to this:


This first line are the column names. The TIME column is the EPOCH time of the record retrieval. I'm able to ingest it into Elastic via Logstash but I want the @timestamp to be the time in the TIME column.

My filter is as follows:

filter {
csv {
separator => ","
columns => [ "UNIT_ID" , "Serial_Number" , "Query Date" ]

    date {
            match => [ "TIME" , "UNIX" ]


When I ingest it now they all have the same @timestamp. What am I missing?

You renamed the TIME column to field [Query Date] using the columns option of your csv filter.

Sure did. Replacing it with TIME fixed the problem. Thanks again Badger.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.