Date filter with nano seconds

[Toontje]

Hi all!

I have a date filed in UNIX format, but not up to the microsecond, but up to the nano second. Example: 1448482607735645
For the date filter to get a decent date out of this i need to divide the content of the date field by 1.000.000.
How do i do this in Logstash?

Thanks,

Ton.

[Toontje]

No worries. Have it.

  ruby {
        code => "event.set('unixdate',event.get('microseconds').to_i / 1000)"
    }
    date {
        match => [ "unixdate", "UNIX_MS" ]
    }