Epoch time conversion is showing wrong time

Elastic Stack Logstash
1

Hello everyone
here i am trying to convert epoch time into human readable format
where it is parsing good but indicating wrong point of time in target field
i didn't get any error also
here is my code:

input {
  exec {
    command  => "aws configservice describe-config-rule-evaluation-status"
    interval =>  600
    codec => "json"
  }
}
filter {
 split {
   field => "ConfigRulesEvaluationStatus"
 }
mutate {
    convert => { "[ConfigRulesEvaluationStatus][LastSuccessfulEvaluationTime]" => "float" }
  }
date {
    match => [ "[ConfigRulesEvaluationStatus][LastSuccessfulEvaluationTime]","UNIX_MS","ISO8601" ]
    #timezone => "Asia/Kolkata"
    target => "myTime"
}
}
output {
elasticsearch {
hosts => ["http://192.168.1.23:9200"]
user => "elastic"
password => "access"
index => "awsconfigrules_b"
}
stdout {codec => rubydebug }
}

My input looks like this:

LastSuccessfulEvaluationTime" => 1493565192.002

my output looks like this:

"myTime" => 1970-01-18T06:56:25.879Z,

Thank you

2

1493565192.002 is the number of seconds since the epoch, so you should use UNIX, not UNIX_MS.

3

Super its Worked
Thank you very much.....::grin:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.