Epoch time fractional number

Elastic Stack Kibana
1

Hello guys,

I have following epoch timestamp : @timestamp":1726149789.77797

And i am using

ruby {
        code => '
            t = Time.at(event.get("@timestamp").to_f * 1000)
            event.set("@timestamp", t.strftime("%Y-%m-%d"))
        '
    }

but still got "_timestampparsefailure" what am i doing wrong?

2

Also this is not working :

ruby { code => 'event.set("timestamp", event.get("@timestamp").to_f)' }

3

Thanks @miiroslavkardos, what about something like this:

ruby {
    code => '
        t = Time.at(event.get("@timestamp").to_f)
        event.set("@timestamp", t.strftime("%Y-%m-%d"))
    '
}

If this too similar to what you've been trying already, you could also try something like this:

ruby {
    code => '
        if event.get("@timestamp")
            event.set("timestamp", event.get("@timestamp").to_f)
        end
    '
}

Hope this is a good starting point here.

Best,

Jessica

4

Hello Jessica,

I got error with both queries.

json - Unrecognized @timestamp value, setting current time to @timestamp, original in _@timestamp field
5

Thanks, @miiroslavkardos. You could try renaming the field in source as suggested on this StackOverflow question.