# EPOCH Parsing | Logstash
**URL:** https://discuss.elastic.co/t/epoch-parsing-logstash/220132
**Category:** Logstash
**Created:** [February 20, 2020, 8:52am UTC](https://discuss.elastic.co/t/epoch-parsing-logstash/220132 "2020-02-20T08:52:28Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@deeshu](https://discuss.elastic.co/u/deeshu)
#### Post date: [February 20, 2020, 8:52am UTC](https://discuss.elastic.co/t/epoch-parsing-logstash/220132/1 "2020-02-20T08:52:28Z")
Hi techs....
Does anyone have grok pattern available to convert epoch timings to date time format. If yes, could any one do the noble cause and share here..
Have seen couple of posts as below for this where Grok UNIX\_MS is used to suffice this requirement. But unluckily when I checked in my environment, I didn't find any such Grok pattern.
> [@Load Epoch time](https://discuss.elastic.co/t/load-epoch-time/44410/7):
>
> Hi , I also tried to put the time filter after the json filter (with and without target). I can see the new loaded index with the new record under the list of indexes in the ElasticSearch (using the command curl 'localhost:9200/\_cat/indices?v') but I can't reach the data in the Kibana filter{ json { source =\> "message" } } filter{ date { match =\> ["startTime", "UNIX"] target =\> "@timestamp" } } The time is added automatically as the load time of the data into the ElasticSearch , I …
TIA,
Deepak Shukla
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 20, 2020, 3:15pm UTC](https://discuss.elastic.co/t/epoch-parsing-logstash/220132/2 "2020-02-20T15:15:51Z")
UNIX\_MS is used in a date filter, not in a grok filter.
---
### Author:  [@deeshu](https://discuss.elastic.co/u/deeshu)
#### Post date: [February 21, 2020, 9:51am UTC](https://discuss.elastic.co/t/epoch-parsing-logstash/220132/3 "2020-02-21T09:51:00Z")
Hi @Badger and @chenbe2204.. Thanks for your inputs.
Basically below is the logs I am getting from AWS WAF and objective is to convert the epoch to date time format. To achieve this, have tried below pipeline, unfortunately it's not working. Any suggestions...any headups?
{"timestamp":1574785248813,"formatVersion":1,"webaclId":"XXXXXXXXXXXXXXXX-YYYYYYYYYYYYY","terminatingRuleId":"Default\_Action","terminatingRuleType":"REGULAR","action":"ALLOW","httpSourceName":"XX"………………………………………………………….
```
else if [APPLICATION] =~ "aem-waf"
{
json {
source => "message"
}
date
{
match => ["epoch_time", "UNIX_MS"]
target => "timestamp"
}
mutate { add_tag => ["json_parse"] }
}
```
TIA,
Deepak Shukla
---
### Author:  [@ITIC](https://discuss.elastic.co/u/ITIC)
#### Post date: [February 21, 2020, 11:28am UTC](https://discuss.elastic.co/t/epoch-parsing-logstash/220132/4 "2020-02-21T11:28:44Z")
Hi
I think this is exaclty what you are looking for: [Unix\_ms time to date](https://discuss.elastic.co/t/unix-ms-time-to-date/220262)
Hope this helps.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 21, 2020, 3:27pm UTC](https://discuss.elastic.co/t/epoch-parsing-logstash/220132/5 "2020-02-21T15:27:48Z")
> [@deeshu](#):
>
> match =\> ["epoch\_time", "UNIX\_MS"]
Your JSON contains a field called timestamp, not epoch\_time.
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [February 21, 2020, 3:37pm UTC](https://discuss.elastic.co/t/epoch-parsing-logstash/220132/6 "2020-02-21T15:37:46Z")
> [@deeshu](#):
>
> 1574785248813
as Badger said you need something like this
```
date { match => ["timestamp", "UNIX_MS","ISO8601"]
target => "timestamp"
}
```
---
### Author:  [@deeshu](https://discuss.elastic.co/u/deeshu)
#### Post date: [February 26, 2020, 3:05am UTC](https://discuss.elastic.co/t/epoch-parsing-logstash/220132/7 "2020-02-26T03:05:30Z")
@elasticforme @Badger @ITIC..... Thanks guys. Awesome. It worked well. Thank you so much for all your contribution. Feeling lil relieved 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 25, 2020, 3:05am UTC](https://discuss.elastic.co/t/epoch-parsing-logstash/220132/8 "2020-03-25T03:05:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.