Epoch to readable timestamp

Hello guys. Hope you are doing well.
Im having a little problem trying to convert an event time in epoch to a readable timestamp, per example in UTC.

So, the log that i have is something like this:


So, i did apply a filter like this to my logstash config:

     mutate {
       convert => { "event_time" => "string"}
       date {
       match => ["event_time","UNIX_MS"]
       target => "event_time"
       timezone => "UTC"
       tag_on_failure => [" "]

And then im getting the event time showing up like this, completely wrong:

event_time : 51132497-04-06T22:34:11.230Z

Hopefully you can help me, thank you for your time :slight_smile: .

Your timestamp is in nanoseconds, not milliseconds. You could try

ruby { code => 'event.set("event_time", event.get("event_time").to_f/1000000)' }
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.