Elasticsearch taking wrong date from my unix time value

Elastic Stack Elasticsearch
1

Hi

I have created an index with date values in this below format

"LastChangedAt" : {
"type" : "date",
"format" : "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||date_time||epoch_millis"
},

Now in logstash i just parsed the xml file using xml filter

xml {
store_xml => true
source => message
target => parsed_message
force_array => false
remove_field => "message"
}
When i view the data in elasticsearch i see that the date value is just the epoch value in timestamp and it is converting the exact value. I even used the date filter to convert unix value to timestamp and checked but it failed

date {
match => [ "[parsed_message][LastChangedAt]", "UNIX" ]
target => "LastChangedAt"
}

Is it a mistake in configuration, if so is there a possibility to recover ?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.